From 439ce5d5e3e56a50dc1e112e67688d6de194e1ae Mon Sep 17 00:00:00 2001 From: swrup Date: Mon, 15 Dec 2025 16:43:49 +0100 Subject: [PATCH] JJ: Description from the destination commit: wip rename JJ: Description from source commit: rename --- src/crypto.ml | 14 ++++++ src/denom_data.ml | 19 ++++++++ src/denomination.ml | 71 ----------------------------- src/management.ml | 15 +++---- src/pg.ml | 4 +- src/secmod.ml | 106 +++++++++++++++++++++++++++++++++----------- src/secmod.mli | 13 +++--- src/signkey.ml | 23 ---------- src/signkey_data.ml | 10 +++++ 9 files changed, 139 insertions(+), 136 deletions(-) create mode 100644 src/denom_data.ml delete mode 100644 src/denomination.ml delete mode 100644 src/signkey.ml create mode 100644 src/signkey_data.ml diff --git a/src/crypto.ml b/src/crypto.ml index 4dee255f..6abf3849 100644 --- a/src/crypto.ml +++ b/src/crypto.ml @@ -155,6 +155,11 @@ module RsaPrivateKey = struct type t = priv + let generate ~bits () = + let priv = generate ~bits () in + let pub = pub_of_priv priv in + (priv, pub) + let pub_of_priv = pub_of_priv let of_octets = Util.Bin_rsa.priv_of_octets let to_octets = Util.Bin_rsa.priv_to_octets @@ -187,3 +192,12 @@ end = struct let to_b32 t = B32.encode t in Jsont.of_of_string ~kind:"RsaSignature" of_b32 ~enc:to_b32 end + +(* some type aliases, just for prettier .mli *) +type eddsa_priv = EddsaPrivateKey.t +type eddsa_pub = EddsaPublicKey.t +type eddsa_sig = EddsaSignature.t +type rsa_priv = RsaPrivateKey.t +type rsa_pub = RsaPublicKey.t +type rsa_sig = RsaSignature.t +type denomination_hash = Bin_type.DenominationHash.t diff --git a/src/denom_data.ml b/src/denom_data.ml new file mode 100644 index 00000000..1304b1bd --- /dev/null +++ b/src/denom_data.ml @@ -0,0 +1,19 @@ +open Crypto + +type t = { + pub: rsa_pub; + priv: rsa_priv; + section_name: string; + value: Amount.t; + stamp_start: Timestamp.t; + stamp_expire_withdraw: Timestamp.t; + stamp_expire_deposit: Timestamp.t; + stamp_expire_legal: Timestamp.t; + fee_withdraw: Amount.t; + fee_deposit: Amount.t; + fee_refresh: Amount.t; + fee_refund: Amount.t; + age_mask: int; + h_pub: denomination_hash; + master_sig: Bin_sig.DenominationKeyValidity.t option; +} diff --git a/src/denomination.ml b/src/denomination.ml deleted file mode 100644 index 7b296362..00000000 --- a/src/denomination.ml +++ /dev/null @@ -1,71 +0,0 @@ -open Crypto - -type t = { - pub: RsaPublicKey.t; - priv: RsaPrivateKey.t; - section_name: string; - value: Amount.t; - stamp_start: Timestamp.t; - stamp_expire_withdraw: Timestamp.t; - stamp_expire_deposit: Timestamp.t; - stamp_expire_legal: Timestamp.t; - fee_withdraw: Amount.t; - fee_deposit: Amount.t; - fee_refresh: Amount.t; - fee_refund: Amount.t; - age_mask: int; - h_pub: Bin_type.DenominationHash.t; - master_sig: Bin_sig.DenominationKeyValidity.t option; -} - -let make - ({ - section_name; - value; - duration_withdraw; - duration_spend; - duration_legal; - fee_withdraw; - fee_deposit; - fee_refresh; - fee_refund; - cipher; - rsa_keysize; - age_restricted= _; - } : - Config.Coin.t) = - assert (cipher = `RSA); - - let stamp_start = Ptime_clock.now () |> Option.some in - let stamp_expire_withdraw = - Timestamp.add_span_exn stamp_start (Some duration_withdraw) - in - let stamp_expire_deposit = - Timestamp.add_span_exn stamp_start (Some duration_spend) - in - let stamp_expire_legal = - Timestamp.add_span_exn stamp_start (Some duration_legal) - in - - let open Mirage_crypto_pk.Rsa in - let priv = generate ~bits:rsa_keysize () in - let pub = pub_of_priv priv in - let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in - let master_sig = None in - { - pub; - priv; - section_name; - value; - stamp_start; - stamp_expire_withdraw; - stamp_expire_deposit; - stamp_expire_legal; - fee_withdraw; - fee_deposit; - fee_refresh; - fee_refund; - age_mask= 0; - h_pub; - master_sig; - } diff --git a/src/management.ml b/src/management.ml index 42f3c129..4dde76e4 100644 --- a/src/management.ml +++ b/src/management.ml @@ -20,7 +20,7 @@ module Keys_get = struct h_pub; master_sig= _; } : - Denomination.t) = + Denom_data.t) = let denom_pub = DenominationKey.of_rsa RsaDenominationKey.{ age_mask; rsa_pub= pub } in @@ -53,7 +53,7 @@ module Keys_get = struct let mk_future_signkey ~sm_signkey_priv ({ pub; priv= _; stamp_start; stamp_expire; stamp_end; master_sig= _ } : - Signkey.t) = + Signkey_data.t) = let signkey_secmod_sig = let open Bin_sig.SigningKeyAnnouncement in let exchange_pub = pub in @@ -67,14 +67,14 @@ module Keys_get = struct let mk_future_keys_response ~sm = let future_signkeys = Secmod.get_signkeys sm - |> List.filter (fun k -> Option.is_none k.Signkey.master_sig) + |> List.filter (fun k -> Option.is_none k.Signkey_data.master_sig) |> List.map (fun signkey -> let sm_signkey_priv = Secmod.get_sm_key_priv sm in mk_future_signkey ~sm_signkey_priv signkey) in let future_denoms = Secmod.get_denoms sm - |> List.filter (fun k -> Option.is_none k.Denomination.master_sig) + |> List.filter (fun k -> Option.is_none k.Denom_data.master_sig) |> List.map (fun denom -> let sm_key_priv = Secmod.get_sm_key_priv sm in mk_future_denom ~sm_key_priv denom) @@ -109,8 +109,7 @@ module Keys_post = struct let denom_hash = HashCode.to_denomination_hash h_denom_pub in let* denom = Secmod.get_denoms sm - |> List.find_opt (fun (denom : Denomination.t) -> - denom.h_pub = denom_hash) + |> List.find_opt (fun (denom : Denom_data.t) -> denom.h_pub = denom_hash) |> function | None -> Fmt.error @@ -138,7 +137,7 @@ module Keys_post = struct let verify_signkey_signature ~sm SignKeySignature.{ key; master_sig } = let* signkey = Secmod.get_signkeys sm - |> List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key) + |> List.find_opt (fun (signkey : Signkey_data.t) -> signkey.pub = key) |> function | None -> Fmt.error @@ -168,7 +167,7 @@ module Keys_post = struct |> list_iter (fun denom -> let error = Error "update_master_signatures sanity check failure" in let* opt = - Pg.lookup_denomination_key db_conn denom.Denomination.h_pub + Pg.lookup_denomination_key db_conn denom.Denom_data.h_pub |> unwrap_err_caqti in let* ( valid_from, diff --git a/src/pg.ml b/src/pg.ml index 0232e954..9ca266ed 100644 --- a/src/pg.ml +++ b/src/pg.ml @@ -100,7 +100,7 @@ let activate_signing_key = in fun (module Conn : CONN) ~master_sig - Signkey. + Signkey_data. { pub; priv= _; @@ -141,7 +141,7 @@ let add_denomination_key = in fun (module Conn : CONN) ~master_sig - Denomination. + Denom_data. { pub; priv= _; diff --git a/src/secmod.ml b/src/secmod.ml index 20aef05c..48cad7e5 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -4,22 +4,19 @@ we just use 1 for now - does the secmod's key as metadata/expiration date? *) open Syntax - -type eddsa_priv = Crypto.EddsaPrivateKey.t -type eddsa_pub = Crypto.EddsaPublicKey.t -type h_denom_pub = Bin_type.DenominationHash.t +open Crypto type t = { lock: Miou.Mutex.t; sm_key_priv: eddsa_priv; sm_key_pub: eddsa_pub; - sk_ht: (eddsa_pub, Signkey.t) Hashtbl.t; + sk_ht: (eddsa_pub, Signkey_data.t) Hashtbl.t; sk_revoked_ht: - (eddsa_pub, Signkey.t * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t; - dn_ht: (h_denom_pub, Denomination.t) Hashtbl.t; + (eddsa_pub, Signkey_data.t * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t; + dn_ht: (denomination_hash, Denom_data.t) Hashtbl.t; dn_revoked_ht: - ( h_denom_pub, - Denomination.t * Bin_sig.MasterDenominationKeyRevocation.t ) + ( denomination_hash, + Denom_data.t * Bin_sig.MasterDenominationKeyRevocation.t ) Hashtbl.t; } @@ -85,7 +82,7 @@ let revoke_denomination t h_denom_pub master_sig = let dir = Fpath.(v "data" / "secmod ") let db_lookup_signkey_data conn fname priv = - let pub = Crypto.EddsaPrivateKey.pub_of_priv priv in + let pub = EddsaPrivateKey.pub_of_priv priv in let* opt = Pg.lookup_signing_key conn pub in match opt with | None -> @@ -97,15 +94,14 @@ let db_lookup_signkey_data conn fname priv = (* TODO master_sig *) let master_sig = None in let v = - Signkey.{ pub; priv; stamp_start; stamp_expire; stamp_end; master_sig } + Signkey_data. + { pub; priv; stamp_start; stamp_expire; stamp_end; master_sig } in Ok v let db_lookup_denom_data conn ~section_name priv = - let pub = Crypto.RsaPrivateKey.pub_of_priv priv in - let h_pub = - Bin_type.DenominationHash.hash (Crypto.RsaPublicKey.to_octets pub) - in + let pub = RsaPrivateKey.pub_of_priv priv in + let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in let* opt = Pg.lookup_denomination_key conn h_pub in match opt with | None -> @@ -126,7 +122,7 @@ let db_lookup_denom_data conn ~section_name priv = age_mask ) -> let master_sig = None in let v = - Denomination. + Denom_data. { pub; priv; @@ -161,14 +157,14 @@ let _store t = get_signkeys t |> List.mapi (fun i key -> let fname = Fpath.(dir / string_of_int i) in - (fname, key.Signkey.priv)) + (fname, key.Signkey_data.priv)) |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key) in let* () = get_denoms t |> List.mapi (fun i key -> let fname = Fpath.(dir / string_of_int i) in - (fname, key.Denomination.priv)) + (fname, key.Denom_data.priv)) |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key) in Ok () @@ -206,17 +202,17 @@ let load conn = match (sm_key_priv, signkeys, denoms) with | None, None, None -> Ok None | Some sm_key_priv, Some signkeys, Some denoms -> - let sm_key_pub = Crypto.EddsaPrivateKey.pub_of_priv sm_key_priv in + let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in let lock = Miou.Mutex.create () in let sk_ht = signkeys - |> List.map (fun v -> (v.Signkey.pub, v)) + |> List.map (fun v -> (v.Signkey_data.pub, v)) |> List.to_seq |> Hashtbl.of_seq in let dn_ht = denoms - |> List.map (fun v -> (v.Denomination.h_pub, v)) + |> List.map (fun v -> (v.Denom_data.h_pub, v)) |> List.to_seq |> Hashtbl.of_seq in @@ -235,19 +231,79 @@ let load conn = }) | _, _, _ -> error_invalid_state +let make_new_signkey () = + let stamp_start = Ptime_clock.now () |> Option.some in + let stamp_expire = + Timestamp.add_span_exn stamp_start + (Some Config.Exchange.signkey_legal_duration) + in + let stamp_end = stamp_expire in + let priv, pub = Mirage_crypto_ec.Ed25519.generate () in + let master_sig = None in + Signkey_data.{ pub; priv; stamp_start; stamp_expire; stamp_end; master_sig } + +let make_new_denom + Config.Coin. + { + section_name; + value; + duration_withdraw; + duration_spend; + duration_legal; + fee_withdraw; + fee_deposit; + fee_refresh; + fee_refund; + cipher; + rsa_keysize; + age_restricted= _; + } = + assert (cipher = `RSA); + let stamp_start = Ptime_clock.now () |> Option.some in + let stamp_expire_withdraw = + Timestamp.add_span_exn stamp_start (Some duration_withdraw) + in + let stamp_expire_deposit = + Timestamp.add_span_exn stamp_start (Some duration_spend) + in + let stamp_expire_legal = + Timestamp.add_span_exn stamp_start (Some duration_legal) + in + let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in + let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in + let master_sig = None in + Denom_data. + { + pub; + priv; + section_name; + value; + stamp_start; + stamp_expire_withdraw; + stamp_expire_deposit; + stamp_expire_legal; + fee_withdraw; + fee_deposit; + fee_refresh; + fee_refund; + age_mask= 0; + h_pub; + master_sig; + } + let make_new () = let lock = Miou.Mutex.create () in let sm_key_priv, sm_key_pub = Mirage_crypto_ec.Ed25519.generate () in let sk_ht = - [ Signkey.make () ] - |> List.map (fun v -> (v.Signkey.pub, v)) + [ make_new_signkey () ] + |> List.map (fun v -> (v.Signkey_data.pub, v)) |> List.to_seq |> Hashtbl.of_seq in let dn_ht = Config.Coin.all_coins - |> List.map Denomination.make - |> List.map (fun v -> (v.Denomination.h_pub, v)) + |> List.map make_new_denom + |> List.map (fun v -> (v.Denom_data.h_pub, v)) |> List.to_seq |> Hashtbl.of_seq in diff --git a/src/secmod.mli b/src/secmod.mli index 2da919ef..ba897b50 100644 --- a/src/secmod.mli +++ b/src/secmod.mli @@ -1,12 +1,11 @@ -type eddsa_priv = Crypto.EddsaPrivateKey.t -type eddsa_pub = Crypto.EddsaPublicKey.t -type h_denom_pub = Bin_type.DenominationHash.t +open Crypto + type t val get_sm_key_priv : t -> eddsa_priv val get_sm_key_pub : t -> eddsa_pub -val get_signkeys : t -> Signkey.t list -val get_denoms : t -> Denomination.t list +val get_signkeys : t -> Signkey_data.t list +val get_denoms : t -> Denom_data.t list val init : (module Pg.CONN) -> t (* - management operations - *) @@ -20,7 +19,7 @@ val add_signkey_master_signatures : val add_denom_master_signatures : (module Pg.CONN) -> t -> - (h_denom_pub * Bin_sig.DenominationKeyValidity.t) list -> + (denomination_hash * Bin_sig.DenominationKeyValidity.t) list -> (unit, string) result val revoke_signkey : @@ -31,6 +30,6 @@ val revoke_signkey : val revoke_denomination : t -> - h_denom_pub -> + denomination_hash -> Bin_sig.MasterDenominationKeyRevocation.t -> (unit, string) result diff --git a/src/signkey.ml b/src/signkey.ml deleted file mode 100644 index 883dfa93..00000000 --- a/src/signkey.ml +++ /dev/null @@ -1,23 +0,0 @@ -open Crypto - -(* TODO master_sig - not sur how to handle master_sig initialization *) -type t = { - pub: EddsaPublicKey.t; - priv: EddsaPrivateKey.t; - stamp_start: Timestamp.t; - stamp_expire: Timestamp.t; - stamp_end: Timestamp.t; - master_sig: Bin_sig.ExchangeSigningKeyValidity.t option; -} - -let make () = - let stamp_start = Ptime_clock.now () |> Option.some in - let stamp_expire = - Timestamp.add_span_exn stamp_start - (Some Config.Exchange.signkey_legal_duration) - in - let stamp_end = stamp_expire in - let priv, pub = Mirage_crypto_ec.Ed25519.generate () in - let master_sig = None in - { pub; priv; stamp_start; stamp_expire; stamp_end; master_sig } diff --git a/src/signkey_data.ml b/src/signkey_data.ml new file mode 100644 index 00000000..727ec103 --- /dev/null +++ b/src/signkey_data.ml @@ -0,0 +1,10 @@ +open Crypto + +type t = { + pub: eddsa_pub; + priv: eddsa_priv; + stamp_start: Timestamp.t; + stamp_expire: Timestamp.t; + stamp_end: Timestamp.t; + master_sig: Bin_sig.ExchangeSigningKeyValidity.t option; +}