wip FDH-RSA

src/crypto.ml

@@ -64,6 +64,7 @@ module Binary_format_rsa = struct
         pub
     | _ -> assert false
 
+  (* custom private key binary format <> than gcrypt *)
   let priv_to_octets ({ e; d; n; p; q; dp; dq; q' } : Mirage_crypto_pk.Rsa.priv)
       =
     z_array_to_octets [| e; d; n; p; q; dp; dq; q' |]
@@ -259,15 +260,10 @@ end
 module RsaSignature : sig
   type t
 
-  val sign : key:Mirage_crypto_pk.Rsa.priv -> string -> t
   val jsont : t Jsont.t
 end = struct
   type t = string
 
-  (* TODO rsa sign *)
-  let sign ~key s =
-    Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~mask:`Yes ~key s
-
   let jsont =
     let of_b32 s = B32.decode s in
     let to_b32 t = B32.encode t in
@@ -282,3 +278,61 @@ type rsa_priv = RsaPrivateKey.t
 type rsa_pub = RsaPublicKey.t
 type rsa_sig = RsaSignature.t
 type denomination_hash = Hash.DenominationHash.t
+
+(* WIP *)
+module FDH_RSA = struct
+  module Kdf = struct
+    module XTR = Hkdf.Make (Digestif.SHA512)
+    module PRF = Hkdf.Make (Digestif.SHA256)
+
+    let kdf ~xts ~ikm ~ctx ~len =
+      let prk = XTR.extract ~salt:xts ikm in
+      let okm = PRF.expand ~prk ~info:ctx len in
+      okm
+  end
+
+  let kdf_mod_n ~n ~xts ~ikm ~ctx =
+    let nbits = Z.numbits n in
+    let len = ((nbits - 1) / 8) + 1 in
+    assert (8 * len = nbits);
+    let rec go ctr =
+      let ctr_be =
+        let b = Bytes.create 2 in
+        Bytes.set_uint16_be b 0 ctr;
+        Bytes.unsafe_to_string b
+      in
+      let ctx = String.cat ctx ctr_be in
+      let okm = Kdf.kdf ~xts ~ikm ~ctx ~len in
+      assert (String.length okm = len);
+      let r = Mirage_crypto_pk.Z_extra.of_octets_be okm in
+      if Z.gt r n then go (succ ctr) else r
+    in
+    go 0
+
+  let rsa_full_domain_hash pub msg =
+    let xts = RsaPublicKey.to_octets pub in
+    let ctx = "RSA-FDA FTpsW!" in
+    let r = kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
+    r
+
+  let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
+    let xts = "Blinding KDF extractor HMAC key" in
+    let ctx = "Blinding KDF" in
+    let r = kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
+    r
+
+  let rsa_blind pub ~bks ~msg =
+    let data = rsa_full_domain_hash pub msg in
+    let bkey = rsa_blinding_key_derive pub bks in
+    let r_e = Z.powm bkey pub.e pub.n in
+    let data_r_e = Z.rem (Z.mul data r_e) pub.n in
+    Mirage_crypto_pk.Z_extra.to_octets_be data_r_e
+
+  (*
+let rsa_sign_fdh priv msg =
+  let pub = Mirage_crypto_pk.Rsa.pub_of_priv priv in
+  let v = rsa_full_domain_hash pub msg in
+  let v = Z.to_bits v in
+  Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~crt_hardening:true ~key:priv v
+  *)
+end