swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

different verify for master sigs

Browse source
This commit is contained in:
swrup 2026-02-21 21:32:18 +01:00
parent 37ed47326a
commit 45df994c13
5 changed files with 108 additions and 138 deletions
Download patch file Download diff file Expand all files Collapse all files

56
src/http_management.ml
View file

@ -3,29 +3,13 @@ open Api
open Hash
module Keys_get = struct
let mk_future_keys_response (module Keys : Keys.S) =
let* future_signkeys = Keys.future_signkeys () in
let* future_denoms = Keys.future_denominations () in
let master_pub = Keys.master_pub in
let denom_secmod_public_key = Keys.secmod_rsa_pub in
let signkey_secmod_public_key = Keys.secmod_eddsa_pub in
Ok
FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub;
denom_secmod_public_key;
signkey_secmod_public_key;
}
let jsont = FutureKeysResponse.jsont
let f req server _env =
Logs.info (fun m -> m "GET /management/keys/");
let keys = Vif.Server.device Devices.keys server in
let (module Keys : Keys.S) = Vif.Server.device Devices.keys server in
let res =
let* v = mk_future_keys_response keys in
let* v = Keys.make_future_keys_response () in
let s = Api.encode_exn jsont v in
Ok s
in
@ -36,9 +20,9 @@ module Keys_post = struct
let verify_dn (module Keys : Keys.S) fdn denom_hash master_sig =
let open FutureDenom in
let open Signatures.DenominationKeyValidity in
let r : r =
let r =
{
master= Config.master_public_key;
R.master= Config.master_public_key;
start= fdn.stamp_start;
expire_withdraw= fdn.stamp_expire_withdraw;
expire_spend= fdn.stamp_expire_deposit;
@ -51,7 +35,7 @@ module Keys_post = struct
denom_hash;
}
in
verify Keys.master_pub master_sig r
verify master_sig r
let verify_denom_sigs (module Keys : Keys.S) denom_sigs =
let* fdn_l = Keys.future_denominations () in
@ -78,15 +62,15 @@ module Keys_post = struct
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ }
master_sig =
let open Signatures.ExchangeSigningKeyValidity in
let r : r =
let r =
{
start= stamp_start;
R.start= stamp_start;
expire= stamp_expire;
end_= stamp_end;
signkey_pub= key;
}
in
verify Keys.master_pub master_sig r
verify master_sig r
let verify_signkey_sigs (module Keys : Keys.S) signkey_sigs =
let* fsk_l = Keys.future_signkeys () in
@ -137,7 +121,7 @@ module Denom_revoke = struct
let verify (module Keys : Keys.S) h_denom_pub
DenomRevocationSignature.{ master_sig } =
let open Signatures.MasterDenominationKeyRevocation in
verify Keys.master_pub master_sig { h_denom_pub }
verify master_sig { h_denom_pub }
let do_ (module Keys : Keys.S) h_denom_pub
DenomRevocationSignature.{ master_sig } =
@ -163,7 +147,7 @@ module Signkey_revoke = struct
let verify (module Keys : Keys.S) exchange_pub
SignkeyRevocationSignature.{ master_sig } =
let open Signatures.MasterSigningKeyRevocation in
verify Keys.master_pub master_sig { exchange_pub }
verify master_sig { exchange_pub }
let do_ (module Keys : Keys.S) exchange_pub
SignkeyRevocationSignature.{ master_sig } =
@ -196,7 +180,7 @@ module Auditors = struct
validity_start;
} =
let open Signatures.MasterAddAuditor in
verify Keys.master_pub master_sig
verify master_sig
{
start_date= validity_start;
auditor_pub;
@ -243,7 +227,7 @@ module Auditors_disable = struct
let verify (module Keys : Keys.S) auditor_pub
AuditorTeardownMessage.{ master_sig; validity_end } =
let open Signatures.MasterDelAuditor in
verify Keys.master_pub master_sig { end_date= validity_end; auditor_pub }
verify master_sig { end_date= validity_end; auditor_pub }
let do_ ~db_conn auditor_pub
AuditorTeardownMessage.{ master_sig= _; validity_end } =
@ -291,7 +275,7 @@ module Wire_fee = struct
wire_fee;
} =
let open Signatures.MasterWireFee in
verify Keys.master_pub master_sig_wire
verify master_sig_wire
{
h_wire_method= Hash.Cstring.H64.hash wire_method;
start_date= fee_start;
@ -353,7 +337,7 @@ module Global_fees = struct
master_sig;
} =
let open Signatures.GlobalFees in
verify Keys.master_pub master_sig
verify master_sig
{
start_date;
end_date;
@ -426,7 +410,7 @@ module Wire = struct
let debit_restrictions = "" in
let* () =
let open Signatures.MasterWireDetails in
verify Keys.master_pub master_sig_wire
verify master_sig_wire
{
h_wire_details= FullPaytoHash.hash payto_uri;
h_conversion_url= Hash.Cstring.H64.hash conversion_url;
@ -436,7 +420,7 @@ module Wire = struct
in
let* () =
let open Signatures.MasterAddWire in
verify Keys.master_pub master_sig_add
verify master_sig_add
{
start_date= validity_start;
h_wire= FullPaytoHash.hash payto_uri;
@ -492,7 +476,7 @@ module Wire_disable = struct
let verify (module Keys : Keys.S)
WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
let open Signatures.MasterDelWire in
verify Keys.master_pub master_sig_del
verify master_sig_del
{ end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri }
let do_ ~db_conn
@ -535,7 +519,7 @@ module Drain = struct
amount;
} =
let open Signatures.MasterDrainProfit in
verify Keys.master_pub master_sig
verify master_sig
{
wtid;
date;
@ -576,7 +560,7 @@ module AmlOfficer = struct
} =
let open Signatures.MasterAmlOfficerStatus in
let is_active = match is_active with true -> 1_l | false -> 0_l in
verify Keys.master_pub master_sig
verify master_sig
{
change_date;
officer_pub;
@ -616,7 +600,7 @@ module Partners = struct
wad_fee;
} =
let open Signatures.PartnerConfiguration in
verify Keys.master_pub master_sig
verify master_sig
{
partner_pub;
start_date;

21
src/keys.ml
View file

@ -12,11 +12,6 @@ module Make (Conn : Pg.CONN) = struct
let conn = (module Conn : Pg.CONN)
(* - *)
let master_pub = Config.Exchange.master_public_key
let secmod_eddsa_pub = Sm_eddsa.sm_pub
let secmod_rsa_pub = Sm_rsa.sm_pub
(* TODO
error "key not found", either:
- we tried to sign with a key that is not ours
@ -37,7 +32,8 @@ module Make (Conn : Pg.CONN) = struct
let find_denomination h_pub = Pg.find_denom conn h_pub |> unwrap_err_caqti
(* TODO
check if database is coherent with secmod *)
check if database is coherent with secmod
=> have something to run independent tests with clean db+sm *)
let signkeys () : Signkey.t list result =
let now = Timestamp.of_ptime @@ Ptime_clock.now () in
Pg.get_active_signkeys conn ~now |> unwrap_err_caqti
@ -173,6 +169,19 @@ module Make (Conn : Pg.CONN) = struct
in
List.filter_map Fun.id l
let make_future_keys_response () =
let* future_signkeys = future_signkeys () in
let* future_denoms = future_denominations () in
Ok
Api.FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= Config.Exchange.master_public_key;
denom_secmod_public_key= Sm_rsa.sm_pub;
signkey_secmod_public_key= Sm_eddsa.sm_pub;
}
let sk_of_future_sk future_sk master_sig =
let Api.FutureSignKey.
{ key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =

4
src/mod_intf.mli
View file

@ -3,9 +3,6 @@ open Crypto
type 'a result = ('a, string) Result.t
module type KEYS = sig
val master_pub : eddsa_pub
val secmod_rsa_pub : eddsa_pub
val secmod_eddsa_pub : eddsa_pub
val sign : eddsa_pub -> string -> eddsa_sig
val sign_denom : rsa_pub -> string -> rsa_sig
val find_signkey : eddsa_pub -> Signkey.t option result
@ -14,6 +11,7 @@ module type KEYS = sig
val denominations : unit -> Denomination.t list result
val future_signkeys : unit -> Api.FutureSignKey.t list result
val future_denominations : unit -> Api.FutureDenom.t list result
val make_future_keys_response : unit -> Api.FutureKeysResponse.t result
val certify_future_signkey :
eddsa_pub -> Signatures.ExchangeSigningKeyValidity.t -> unit result

69
src/signatures.ml
View file

@ -145,20 +145,21 @@ end
(* --- Packed Signatures --- *)
module MK (R : sig
module type R = sig
type r
val bin : r Bin.t
end) : sig
end
module type SIGNATURE = sig
open Crypto
type r = R.r
type r
type t
val signf : (string -> EddsaSignature.t) -> r -> t
(* todo
- could have another functor with `verify`'s key set to config's master_public_key
- type for unknown/verified signatures? (nk/ok) *)
val verify : EddsaPublicKey.t -> t -> r -> (unit, string) result
val jsont : t Jsont.t
@ -166,10 +167,11 @@ end) : sig
(* escape hatch, only needed for /keys `exchange_sig` (signature over contatentation of all of the master_sigs) *)
val to_octets : t -> string
end = struct
end
module MK (R : R) : SIGNATURE with type r := R.r = struct
open Crypto
type r = R.r
type t = EddsaSignature.t
let to_string = Bin.to_string R.bin
@ -180,6 +182,14 @@ end = struct
let to_octets t = EddsaSignature.to_octets t
end
module MK_master_sig (R : R) = struct
include MK (R)
let verify = verify Config.Exchange.master_public_key
end
(* ---- *)
module DenominationKeyAnnouncement = struct
module R = struct
(* CS: use purpose TALER_SIGNATURE_SM_CS_DENOMINATION_KEY *)
@ -207,7 +217,6 @@ module DenominationKeyAnnouncement = struct
|> sealr
end
include R
include MK (R)
end
@ -232,7 +241,6 @@ module SigningKeyAnnouncement = struct
|> sealr
end
include R
include MK (R)
end
@ -301,8 +309,7 @@ module DenominationKeyValidity = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module ExchangeSigningKeyValidity = struct
@ -329,8 +336,7 @@ module ExchangeSigningKeyValidity = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterDenominationKeyRevocation = struct
@ -348,8 +354,7 @@ module MasterDenominationKeyRevocation = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterSigningKeyRevocation = struct
@ -367,8 +372,7 @@ module MasterSigningKeyRevocation = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterAddAuditor = struct
@ -392,8 +396,7 @@ module MasterAddAuditor = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterDelAuditor = struct
@ -414,8 +417,7 @@ module MasterDelAuditor = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module GlobalFees = struct
@ -470,8 +472,7 @@ module GlobalFees = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterWireDetails = struct
@ -509,8 +510,7 @@ module MasterWireDetails = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterAddWire = struct
@ -552,8 +552,7 @@ module MasterAddWire = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterDelWire = struct
@ -574,8 +573,7 @@ module MasterDelWire = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterDrainProfit = struct
@ -603,8 +601,7 @@ module MasterDrainProfit = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module MasterAmlOfficerStatus = struct
@ -630,8 +627,7 @@ module MasterAmlOfficerStatus = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module PartnerConfiguration = struct
@ -670,8 +666,7 @@ module PartnerConfiguration = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module WadPartnerSignature = struct
@ -718,7 +713,6 @@ module WadPartnerSignature = struct
|> sealr
end
include R
include MK (R)
end
@ -748,8 +742,7 @@ module MasterWireFee = struct
|> sealr
end
include R
include MK (R)
include MK_master_sig (R)
end
module ExchangeKeyValidity = struct
@ -815,7 +808,6 @@ module ExchangeKeyValidity = struct
|> sealr
end
include R
include MK (R)
end
@ -838,7 +830,6 @@ module ExchangeKeySet = struct
|> sealr
end
include R
include MK (R)
end