From 28304360d31be05135e5240ec34726b84b1b7d2b Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 24 Feb 2026 23:20:50 +0100
Subject: [PATCH]

---
 src/fdh_rsa.ml      | 21 +++++++--------------
 src/secmod_rsa.ml   |  4 +---
 test/test_crypto.ml |  8 +++++---
 3 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/src/fdh_rsa.ml b/src/fdh_rsa.ml
index 44713d45..f305d6ea 100644
--- a/src/fdh_rsa.ml
+++ b/src/fdh_rsa.ml
@@ -56,18 +56,14 @@ let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
   let r = Kdf.kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
   gcd_validate r pub.n; r
 
-let rsa_blind pub ~bks msg =
+let blind_msg pub ~bks msg =
   let data = rsa_full_domain_hash pub msg in
   let bkey = rsa_blinding_key_derive pub bks in
   let r_e = Z.powm_sec bkey pub.e pub.n in
   let data_r_e = Z.rem (Z.mul data r_e) pub.n in
   Z_extra.to_octets_be data_r_e
 
-(* decrypt <=> sign *)
-let rsa_sign_blinded priv bmsg =
-  Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key:priv bmsg
-
-let rsa_unblind pub ~bks bsig =
+let unblind_sig pub ~bks bsig =
   let data = Z_extra.of_octets_be bsig in
   let bkey = rsa_blinding_key_derive pub bks in
   let r_inv =
@@ -79,16 +75,13 @@ let rsa_unblind pub ~bks bsig =
   let data = Z.rem (Z.mul data r_inv) pub.n in
   Z_extra.to_octets_be data
 
-let sign ~priv ~pub ~bks ~msg =
-  let bmsg = rsa_blind pub ~bks msg in
-  let bsig = rsa_sign_blinded priv bmsg in
-  let sig_ = rsa_unblind pub ~bks bsig in
-  sig_
+(* decrypt <=> sign *)
+let sign ~key bmsg = Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
 
-let verify pub ~msg ~sig_ =
-  let msg_fdh = rsa_full_domain_hash pub msg in
+let verify ~key s ~msg =
+  let msg_fdh = rsa_full_domain_hash key msg in
   let s1 = Z_extra.to_octets_be msg_fdh in
-  let s2 = Mirage_crypto_pk.Rsa.encrypt ~key:pub sig_ in
+  let s2 = Mirage_crypto_pk.Rsa.encrypt ~key s in
   match Eqaf.equal s1 s2 with
   | false -> Fmt.error "RSA signature verification failed"
   | true -> Ok ()
diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml
index ef7d2bf8..fef265f1 100644
--- a/src/secmod_rsa.ml
+++ b/src/secmod_rsa.ml
@@ -259,9 +259,7 @@ module Make () = struct
 
   let sign h_pub msg =
     let+ k = find h_pub in
-    (* TODO fdh-rsa *)
-    let bks = "deadbeaf" in
-    let data = Fdh_rsa.sign ~priv:k.priv ~pub:k.pub ~bks ~msg in
+    let data = Fdh_rsa.sign ~key:k.priv msg in
     data
 
   let revoke h_pub =
diff --git a/test/test_crypto.ml b/test/test_crypto.ml
index c26481f3..13cac4df 100644
--- a/test/test_crypto.ml
+++ b/test/test_crypto.ml
@@ -104,7 +104,7 @@ let () =
   in
   let bks = blinding_key_secret |> decode in
   let msg = decode message_hash in
-  let bmsg = Fdh_rsa.rsa_blind pub ~bks msg in
+  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
   assert (encode bmsg = blinded_message);
 
   ()
@@ -116,8 +116,10 @@ let () =
   let priv, pub = RsaPrivateKey.generate ~bits:2048 () in
   let bks = "deadbeaf" in
   let msg = "uhuh." in
-  let sig_ = Fdh_rsa.sign ~priv ~pub ~bks ~msg in
-  let res = Fdh_rsa.verify pub ~msg ~sig_ in
+  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
+  let bsig = Fdh_rsa.sign ~key:priv bmsg in
+  let sig_ = Fdh_rsa.unblind_sig pub ~bks bsig in
+  let res = Fdh_rsa.verify ~key:pub sig_ ~msg in
   assert (Result.is_ok res);
 
   ()