swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

.

Browse source
This commit is contained in:
swrup 2026-02-17 13:01:09 +01:00
parent 79920eeff5
commit 46a662c903
6 changed files with 125 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/api.ml
View file

@ -922,6 +922,19 @@ module SignKey = struct
master_sig: ExchangeSigningKeyValidity.t; master_sig: ExchangeSigningKeyValidity.t;
} }
(* TODO rm one of them *)
let of_signkey
Signkey.
{
pub;
stamp_start;
stamp_expire;
stamp_end;
master_sig;
revoked_sig= _;
} =
{ key= pub; stamp_start; stamp_expire; stamp_end; master_sig }
let jsont = let jsont =
let make key stamp_start stamp_expire stamp_end master_sig = let make key stamp_start stamp_expire stamp_end master_sig =
{ key; stamp_start; stamp_expire; stamp_end; master_sig } { key; stamp_start; stamp_expire; stamp_end; master_sig }

71
src/http_information.ml
View file

@ -41,7 +41,6 @@ let denomgroup_of_denomdata
master_sig; master_sig;
revoked_sig= _; revoked_sig= _;
} = } =
let master_sig = match master_sig with None -> assert false | Some v -> v in
let denoms = let denoms =
[ [
RsaDenom. RsaDenom.
@ -112,92 +111,66 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date =
let wallet_balance_limit_without_kyc = None in let wallet_balance_limit_without_kyc = None in
let hard_limits = [] in let hard_limits = [] in
let zero_limits = [] in let zero_limits = [] in
let denom_data_l = let dn_l =
(* TODO sm-db *)
(*Pg.get_denominations db_conn |> unwrap_err_caqti *) (*Pg.get_denominations db_conn |> unwrap_err_caqti *)
Sm.get_denoms_data () Sm.get_denominations ()
in |>
let denom_data_l =
(* reverse chronological order *) (* reverse chronological order *)
List.sort List.sort (fun a b ->
(fun a b -> Stdlib.compare b.Denomination.stamp_start a.stamp_start) Stdlib.compare b.Denomination.stamp_start a.stamp_start)
denom_data_l
in in
let list_issue_date = let list_issue_date =
match denom_data_l with match dn_l with
| [] -> Time.Timestamp.never | [] -> Timestamp.never
| v :: _ -> v.Denomination.stamp_start | dn :: _ -> dn.Denomination.stamp_start
in in
let denominations = let denominations =
let open Denomination in
(* if `?last_issue_date` query param does not exactly match the `stamp_start` (* if `?last_issue_date` query param does not exactly match the `stamp_start`
of one of the denomination keys, all keys are returned *) of one of the denomination keys, all keys are returned *)
let open Denomination in
let l = let l =
match last_issue_date with match last_issue_date with
| None -> denom_data_l | None -> dn_l
| Some last_issue_date -> ( | Some last_issue_date -> (
match match
List.find_opt List.find_opt
(fun v -> (fun v -> Timestamp.compare v.stamp_start last_issue_date = 0)
Time.Timestamp.compare v.stamp_start last_issue_date = 0) dn_l
denom_data_l
with with
| None -> denom_data_l | None -> dn_l
| Some _ -> | Some _ ->
List.filter List.filter
(fun v -> (fun v ->
Time.Timestamp.compare v.stamp_start last_issue_date >= 0) Time.Timestamp.compare v.stamp_start last_issue_date >= 0)
denom_data_l) dn_l)
in in
List.map denomgroup_of_denomdata l List.map denomgroup_of_denomdata l
in in
let signkeys = let signkeys =
(* TODO sm-db
use database signkey data / verify secmod and database are in sync *)
(* (*
let now = Ptime_clock.now () |> Option.some in let now = Ptime_clock.now () |> Option.some in
let+ signkey_data_l = Pg.get_active_signkeys db_conn ~now |> unwrap_err_caqti in*) let+ signkey_data_l = Pg.get_active_signkeys db_conn ~now |> unwrap_err_caqti in*)
let signkey_data_l = Sm.get_signkeys_data () in Sm.get_signkeys ()
let signkey_data_l = |> List.sort (fun a b ->
List.sort let open Signkey in
(fun a b -> Stdlib.compare b.stamp_start a.stamp_start)
let open Signkey in |> List.map Api.SignKey.of_signkey
Stdlib.compare b.stamp_start a.stamp_start)
signkey_data_l
in
List.filter_map
(fun Signkey.
{
pub;
stamp_start;
stamp_expire;
stamp_end;
master_sig;
revoked_sig= _;
} ->
match master_sig with
| None -> None
| Some master_sig ->
Some
SignKey.
{ key= pub; stamp_start; stamp_expire; stamp_end; master_sig })
signkey_data_l
in in
let exchange_pub = let exchange_pub =
(* the eddsa pub key used to sign exchange_sig *) (* the eddsa pub key used to sign exchange_sig *)
match signkeys with match signkeys with
| [] -> Fmt.failwith "exchange has no active signkey" | [] -> Fmt.failwith "exchange has no active signkey"
| v :: _ -> v.SignKey.key | sk :: _ -> sk.SignKey.key
in in
let exchange_sig = let exchange_sig =
(* Compact EdDSA signature (binary-only) over the (* Compact EdDSA signature (binary-only) over the
contatentation of all of the master_sigs (in reverse contatentation of all of the master_sigs (in reverse
chronological order by group) in the arrays under "denominations". *) chronological order by group) in the arrays under "denominations". *)
let hc = let hc =
denom_data_l dn_l
|> List.filter_map (fun v -> v.Denomination.master_sig) |> List.map (fun dn -> dn.Denomination.master_sig)
|> List.map Signatures.DenominationKeyValidity.to_octets |> List.map Signatures.DenominationKeyValidity.to_octets
|> String.concat "" |> String.concat ""
|> Hash.H64.hash |> Hash.H64.hash

109
src/http_management.ml
View file

@ -3,93 +3,12 @@ open Api
open Hash open Hash
module Keys_get = struct module Keys_get = struct
let mk_future_denom (module Sm : Secmod.S) ~section_name
({
pub;
value;
stamp_start;
stamp_expire_withdraw;
stamp_expire_deposit;
stamp_expire_legal;
fee_withdraw;
fee_deposit;
fee_refresh;
fee_refund;
age_mask;
h_pub;
master_sig= _;
revoked_sig= _;
} :
Denomination.t) =
let denom_pub =
DenominationKey.of_rsa RsaDenominationKey.{ age_mask; rsa_pub= pub }
in
let denom_secmod_sig =
let open Signatures.DenominationKeyAnnouncement in
let h_denom_pub = h_pub in
let h_section_name = Hash.Cstring.H64.hash section_name in
let anchor_time = stamp_start in
let duration_withdraw =
Timestamp.diff stamp_start stamp_expire_withdraw
in
sign_f ~f:Sm.sign_with_sm_key
{ h_denom_pub; h_section_name; anchor_time; duration_withdraw }
in
FutureDenom.
{
section_name;
value;
stamp_start;
stamp_expire_withdraw;
stamp_expire_deposit;
stamp_expire_legal;
denom_pub;
fee_withdraw;
fee_deposit;
fee_refresh;
fee_refund;
denom_secmod_sig;
}
let mk_future_signkey (module Sm : Secmod.S)
({
pub;
stamp_start;
stamp_expire;
stamp_end;
master_sig= _;
revoked_sig= _;
} :
Signkey.t) =
let signkey_secmod_sig =
let open Signatures.SigningKeyAnnouncement in
let exchange_pub = pub in
let anchor_time = stamp_start in
let duration = Timestamp.diff stamp_start stamp_expire in
sign_f ~f:Sm.sign_with_sm_key { exchange_pub; anchor_time; duration }
in
FutureSignKey.
{ key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
let mk_future_keys_response (module Sm : Secmod.S) = let mk_future_keys_response (module Sm : Secmod.S) =
let future_signkeys = let future_signkeys = Sm.get_future_signkeys () in
Sm.get_signkeys_data () let future_denoms = Sm.get_future_denominations () in
|> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
|> List.map (fun signkey -> mk_future_signkey (module Sm) signkey)
in
let future_denoms =
Sm.get_denoms_data ()
|> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
|> List.map (fun dn_data ->
let opt = Sm.find_denom_section_name dn_data.Denomination.h_pub in
match opt with
| None -> Fmt.failwith "section_name not found."
| Some section_name ->
mk_future_denom (module Sm) ~section_name dn_data)
in
let master_pub = Config.Exchange.master_public_key in let master_pub = Config.Exchange.master_public_key in
let denom_secmod_public_key = Sm.get_sm_key_pub () in let denom_secmod_public_key = Sm.sm_pubkey in
let signkey_secmod_public_key = Sm.get_sm_key_pub () in let signkey_secmod_public_key = Sm.sm_pubkey in
FutureKeysResponse. FutureKeysResponse.
{ {
future_denoms; future_denoms;
@ -144,7 +63,7 @@ module Keys_post = struct
let verify_signkey_signature (module Sm : Secmod.S) let verify_signkey_signature (module Sm : Secmod.S)
SignKeySignature.{ key; master_sig } = SignKeySignature.{ key; master_sig } =
let* signkey = let* signkey =
match Sm.find_signkey_data key with match Sm.find_signkey key with
| None -> | None ->
Fmt.error Fmt.error
"404 not found, One of the keys for which a signature was provided \ "404 not found, One of the keys for which a signature was provided \
@ -170,18 +89,18 @@ module Keys_post = struct
let do_ ~db_conn:_ (module Sm : Secmod.S) let do_ ~db_conn:_ (module Sm : Secmod.S)
MasterSignatures.{ denom_sigs; signkey_sigs } = MasterSignatures.{ denom_sigs; signkey_sigs } =
let* () = let* () =
signkey_sigs list_iter
|> List.map (fun SignKeySignature.{ key; master_sig } -> (fun SignKeySignature.{ key; master_sig } ->
(key, master_sig)) Sm.certify_future_signkey key master_sig)
|> Sm.add_signkey_master_signatures signkey_sigs
in in
let* () = let* () =
denom_sigs list_iter
|> List.map (fun DenomSignature.{ h_denom_pub; master_sig } -> (fun DenomSignature.{ h_denom_pub; master_sig } ->
(h_denom_pub, master_sig)) Sm.certify_future_denomination h_denom_pub master_sig)
|> Sm.add_denom_master_signatures denom_sigs
in in
let* () = Sm.store () in let* () = Sm.save () in
Ok () Ok ()
let jsont = MasterSignatures.jsont let jsont = MasterSignatures.jsont

149
src/secmod.ml
View file

@ -15,7 +15,7 @@ module type S = sig
val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_signkeys : unit -> Api.FutureSignKey.t list
val get_future_denominations : unit -> Api.FutureDenom.t list val get_future_denominations : unit -> Api.FutureDenom.t list
val find_signkey : eddsa_pub -> Signkey.t option val find_signkey : eddsa_pub -> Signkey.t option
val find_denomination : rsa_pub -> Denomination.t option val find_denomination : denom_hash -> Denomination.t option
val certify_future_signkey : val certify_future_signkey :
eddsa_pub -> eddsa_pub ->
@ -23,7 +23,7 @@ module type S = sig
(unit, string) result (unit, string) result
val certify_future_denomination : val certify_future_denomination :
rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result
val revoke_signkey : val revoke_signkey :
eddsa_pub -> eddsa_pub ->
@ -31,7 +31,7 @@ module type S = sig
(unit, string) result (unit, string) result
val revoke_denomination : val revoke_denomination :
rsa_pub -> denom_hash ->
Signatures.MasterDenominationKeyRevocation.t -> Signatures.MasterDenominationKeyRevocation.t ->
(unit, string) result (unit, string) result
@ -41,46 +41,48 @@ end
module Make (Conn : Pg.CONN) = struct module Make (Conn : Pg.CONN) = struct
open Syntax open Syntax
open Crypto open Crypto
module DenominationHash = Hash.DenominationHash
type sk = Signkey.t type sk = Signkey.t
type future_sk = Api.FutureSignKey.t type future_sk = Api.FutureSignKey.t
type dn = Denomination.t type dn = Denomination.t
type future_dn = Api.FutureDenom.t type future_dn = Api.FutureDenom.t
(* TODO use lock! *) (* TODO ! use lock *)
(* not sure what to do with coin section_name, rm if possible *)
type t = { type t = {
sm_key: eddsa_priv; sm_key: eddsa_priv;
sm_pubkey: eddsa_pub; sm_pubkey: eddsa_pub;
sk_ht: (eddsa_pub, sk) Hashtbl.t; sk_ht: (eddsa_pub, sk) Hashtbl.t;
dn_ht: (rsa_pub, dn) Hashtbl.t; dn_ht: (denom_hash, dn) Hashtbl.t;
sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t;
dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t;
future_sk_ht: (eddsa_pub, future_sk) Hashtbl.t; future_sk_ht: (eddsa_pub, future_sk) Hashtbl.t;
future_dn_ht: (rsa_pub, future_dn) Hashtbl.t; future_dn_ht: (denom_hash, future_dn) Hashtbl.t;
future_sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; future_sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t;
future_dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; future_dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t;
dn_section_name_ht: (rsa_pub, string) Hashtbl.t; dn_section_name_ht: (denom_hash, string) Hashtbl.t;
} }
let database_find_sk conn fname pub = let sm_key_fname = Fpath.(Config.secrets_dir / "sm_key")
let sk_key_fname i = Fpath.(Config.secrets_dir / Fmt.str "sk_%d" i)
let dn_key_fname section_name =
Fpath.(Config.secrets_dir / Fmt.str "dn_%s" section_name)
let database_find_sk conn pub =
let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
match opt with match opt with
| None -> | None ->
Fmt.error Fmt.error "secmod failure: a signkey could not be found in database"
"load_signkey error, no associated data found in database for \
signkey `%s`."
(Fpath.to_string fname)
| Some sk_data -> Ok sk_data | Some sk_data -> Ok sk_data
let database_find_dn conn ~section_name pub = let database_find_dn conn h_pub =
let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
match opt with match opt with
| None -> | None ->
Fmt.error Fmt.error
"load_denom error no associated metadata found in database for \ "secmod failure: a denomination could not be found in database"
denomination `%s`."
section_name
| Some dn_data -> Ok dn_data | Some dn_data -> Ok dn_data
(* TODO clean up *) (* TODO clean up *)
@ -88,18 +90,10 @@ module Make (Conn : Pg.CONN) = struct
let error_invalid_state = let error_invalid_state =
Fmt.error "secmod load error: invalid store state." Fmt.error "secmod load error: invalid store state."
in in
let* sm_key = Data_file.read_eddsa Fpath.(Config.secrets_dir / "sk_sm") in let* sm_key = Data_file.read_eddsa sm_key_fname in
let* sk_keys = let* sk_keys =
let l = let l = List.init 1 sk_key_fname in
List.init 1 (fun i -> Fpath.(Config.secrets_dir / Fmt.str "sk_%d" i)) let* l = list_map (fun fname -> Data_file.read_eddsa fname) l in
in
let* l =
list_map
(fun fname ->
let+ opt = Data_file.read_eddsa fname in
Option.map (fun priv -> (fname, priv)) opt)
l
in
match opt_list l with Error () -> error_invalid_state | Ok opt -> Ok opt match opt_list l with Error () -> error_invalid_state | Ok opt -> Ok opt
in in
let* dn_keys = let* dn_keys =
@ -108,8 +102,7 @@ module Make (Conn : Pg.CONN) = struct
list_map list_map
(fun coin -> (fun coin ->
let section_name = coin.section_name in let section_name = coin.section_name in
let fname = Fpath.(Config.secrets_dir / section_name) in let+ opt = Data_file.read_rsa (dn_key_fname section_name) in
let+ opt = Data_file.read_rsa fname in
Option.map (fun priv -> (section_name, priv)) opt) Option.map (fun priv -> (section_name, priv)) opt)
all_coins all_coins
in in
@ -125,9 +118,9 @@ module Make (Conn : Pg.CONN) = struct
(* sk *) (* sk *)
let* l = let* l =
list_map list_map
(fun (fname, priv) -> (fun priv ->
let pub = EddsaPrivateKey.pub_of_priv priv in let pub = EddsaPrivateKey.pub_of_priv priv in
let+ sk = database_find_sk conn fname pub in let+ sk = database_find_sk conn pub in
((pub, sk), (pub, priv))) ((pub, sk), (pub, priv)))
sk_keys sk_keys
in in
@ -136,19 +129,28 @@ module Make (Conn : Pg.CONN) = struct
(list_to_ht sk_l, list_to_ht priv_l) (list_to_ht sk_l, list_to_ht priv_l)
in in
(* dn *) (* dn *)
let dn_section_name_ht = Hashtbl.create 0xff in
let* l = let* l =
list_map list_map
(fun (section_name, priv) -> (fun (section_name, priv) ->
let pub = RsaPrivateKey.pub_of_priv priv in let h_pub =
let+ dn = database_find_dn conn ~section_name pub in priv
((pub, dn), (pub, priv))) |> RsaPrivateKey.pub_of_priv
|> RsaPublicKey.to_octets
|> DenominationHash.hash
in
(* fill dn_section_name_ht *)
Hashtbl.replace dn_section_name_ht h_pub section_name;
let+ dn = database_find_dn conn h_pub in
((h_pub, dn), (h_pub, priv)))
dn_keys dn_keys
in in
let dn_ht, dn_key_ht = let dn_ht, dn_key_ht =
let dn_l, priv_l = List.split l in match List.split l with l1, l2 -> (list_to_ht l1, list_to_ht l2)
(list_to_ht dn_l, list_to_ht priv_l)
in in
(* future keys are not stored (until they are signed) (* future keys are not stored anywhere until they are certified with a master_sig
so we don't have any future key to load *) so we don't have any future key to load *)
let t = let t =
{ {
@ -162,7 +164,7 @@ module Make (Conn : Pg.CONN) = struct
future_dn_ht= Hashtbl.create 0xff; future_dn_ht= Hashtbl.create 0xff;
future_sk_key_ht= Hashtbl.create 0xff; future_sk_key_ht= Hashtbl.create 0xff;
future_dn_key_ht= Hashtbl.create 0xff; future_dn_key_ht= Hashtbl.create 0xff;
dn_section_name_ht= Hashtbl.create 0xff; dn_section_name_ht;
} }
in in
Ok (Some t) Ok (Some t)
@ -211,17 +213,16 @@ module Make (Conn : Pg.CONN) = struct
age_restricted= _; age_restricted= _;
} = } =
assert (cipher = `RSA); assert (cipher = `RSA);
let open Time in let start = Time.Absolute.of_ptime (Ptime_clock.now ()) in
let start = Absolute.of_ptime (Ptime_clock.now ()) in
let stamp_start = Timestamp.of_absolute start in let stamp_start = Timestamp.of_absolute start in
let stamp_expire_withdraw = let stamp_expire_withdraw =
Timestamp.of_absolute @@ Absolute.add start duration_withdraw Timestamp.of_absolute @@ Time.Absolute.add start duration_withdraw
in in
let stamp_expire_deposit = let stamp_expire_deposit =
Timestamp.of_absolute @@ Absolute.add start duration_spend Timestamp.of_absolute @@ Time.Absolute.add start duration_spend
in in
let stamp_expire_legal = let stamp_expire_legal =
Timestamp.of_absolute @@ Absolute.add start duration_legal Timestamp.of_absolute @@ Time.Absolute.add start duration_legal
in in
let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
let open Api in let open Api in
@ -229,11 +230,10 @@ module Make (Conn : Pg.CONN) = struct
RsaDenominationKey.{ age_mask= 0; rsa_pub= pub } RsaDenominationKey.{ age_mask= 0; rsa_pub= pub }
in in
let denom_pub = DenominationKey.Rsa rsa_denomination_key in let denom_pub = DenominationKey.Rsa rsa_denomination_key in
let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
let denom_secmod_sig = let denom_secmod_sig =
let open Signatures.DenominationKeyAnnouncement in let open Signatures.DenominationKeyAnnouncement in
let h_denom_pub = let h_denom_pub = h_pub in
Hash.DenominationHash.hash (RsaPublicKey.to_octets pub)
in
let h_section_name = Hash.Cstring.H64.hash section_name in let h_section_name = Hash.Cstring.H64.hash section_name in
let anchor_time = stamp_start in let anchor_time = stamp_start in
let duration_withdraw = let duration_withdraw =
@ -259,8 +259,8 @@ module Make (Conn : Pg.CONN) = struct
denom_secmod_sig; denom_secmod_sig;
} }
in in
Hashtbl.replace t.future_dn_ht pub future_dn; Hashtbl.replace t.future_dn_ht h_pub future_dn;
Hashtbl.replace t.future_dn_key_ht pub priv; Hashtbl.replace t.future_dn_key_ht h_pub priv;
() ()
let make_new () = let make_new () =
@ -297,13 +297,14 @@ module Make (Conn : Pg.CONN) = struct
let sm_pubkey = t.sm_pubkey let sm_pubkey = t.sm_pubkey
let sign_with_sm_key s = sign_with_sm_key t s let sign_with_sm_key s = sign_with_sm_key t s
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
let sign_with_signkey ~pub s = let sign_with_signkey ~pub s =
match Hashtbl.find_opt t.sk_key_ht pub with match Hashtbl.find_opt t.sk_key_ht pub with
| None -> Fmt.failwith "secmod failure: signkey not found." | None -> Fmt.failwith "secmod failure: signkey not found."
| Some priv -> EddsaSignature.sign ~key:priv s | Some priv -> EddsaSignature.sign ~key:priv s
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
let verify_with_master_key = let verify_with_master_key =
EddsaSignature.verify ~key:Config.master_public_key EddsaSignature.verify ~key:Config.master_public_key
@ -365,14 +366,15 @@ module Make (Conn : Pg.CONN) = struct
let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in
Ok ()) Ok ())
let certify_future_denomination pub master_sig = let certify_future_denomination h_pub master_sig =
match match
( Hashtbl.find_opt t.future_dn_ht pub, ( Hashtbl.find_opt t.future_dn_ht h_pub,
Hashtbl.find_opt t.future_dn_key_ht pub ) Hashtbl.find_opt t.future_dn_key_ht h_pub )
with with
| None, _ | _, None -> Error "secmod failure: future signkey not found." | None, _ | _, None ->
Error "secmod failure: future denomination not found."
| Some future_dn, Some priv -> ( | Some future_dn, Some priv -> (
match Hashtbl.find_opt t.dn_ht pub with match Hashtbl.find_opt t.dn_ht h_pub with
| Some _dn -> | Some _dn ->
Error Error
"secmod failure: this denomination already has a master signature" "secmod failure: this denomination already has a master signature"
@ -385,7 +387,7 @@ module Make (Conn : Pg.CONN) = struct
stamp_expire_withdraw; stamp_expire_withdraw;
stamp_expire_deposit; stamp_expire_deposit;
stamp_expire_legal; stamp_expire_legal;
denom_pub= _; denom_pub;
fee_withdraw; fee_withdraw;
fee_deposit; fee_deposit;
fee_refresh; fee_refresh;
@ -394,15 +396,14 @@ module Make (Conn : Pg.CONN) = struct
} = } =
future_dn future_dn
in in
(* TODO dn hash let rsa_pub =
need to compute it from denom_pub *) match denom_pub with
let h_pub = | Rsa Api.RsaDenominationKey.{ age_mask= _; rsa_pub } -> rsa_pub
Hash.DenominationHash.hash (RsaPublicKey.to_octets pub)
in in
let dn = let dn =
Denomination. Denomination.
{ {
pub; pub= rsa_pub;
value; value;
stamp_start; stamp_start;
stamp_expire_withdraw; stamp_expire_withdraw;
@ -418,11 +419,11 @@ module Make (Conn : Pg.CONN) = struct
revoked_sig= None; revoked_sig= None;
} }
in in
Hashtbl.replace t.dn_ht pub dn; Hashtbl.replace t.dn_ht h_pub dn;
Hashtbl.replace t.dn_key_ht pub priv; Hashtbl.replace t.dn_key_ht h_pub priv;
Hashtbl.replace t.dn_section_name_ht pub section_name; Hashtbl.replace t.dn_section_name_ht h_pub section_name;
Hashtbl.remove t.future_dn_ht pub; Hashtbl.remove t.future_dn_ht h_pub;
Hashtbl.remove t.future_dn_key_ht pub; Hashtbl.remove t.future_dn_key_ht h_pub;
let* () = Pg.insert_denom (module Conn) dn |> unwrap_err_caqti in let* () = Pg.insert_denom (module Conn) dn |> unwrap_err_caqti in
Ok ()) Ok ())
@ -448,16 +449,11 @@ module Make (Conn : Pg.CONN) = struct
Ok () Ok ()
let save () = let save () =
let* () = let* () = Data_file.write_eddsa sm_key_fname t.sm_key in
let fname = Fpath.(Config.secrets_dir / "sk_sm") in
Data_file.write_eddsa fname t.sm_key
in
let* () = let* () =
Hashtbl.to_seq_values t.sk_key_ht Hashtbl.to_seq_values t.sk_key_ht
|> List.of_seq |> List.of_seq
|> List.mapi (fun i priv -> |> List.mapi (fun i priv -> Data_file.write_eddsa (sk_key_fname i) priv)
let fname = Fpath.(Config.secrets_dir / Fmt.str "sk_%d" i) in
Data_file.write_eddsa fname priv)
|> list_iter Fun.id |> list_iter Fun.id
in in
let* () = let* () =
@ -469,8 +465,7 @@ module Make (Conn : Pg.CONN) = struct
| None -> Error "invalid state, section_name not found" | None -> Error "invalid state, section_name not found"
| Some s -> Ok s | Some s -> Ok s
in in
let fname = Fpath.(Config.secrets_dir / section_name) in Data_file.write_rsa (dn_key_fname section_name) priv)
Data_file.write_rsa fname priv)
in in
Logs.info (fun m -> m "saved secmod private keys data"); Logs.info (fun m -> m "saved secmod private keys data");
Ok () Ok ()

6
src/secmod.mli
View file

@ -15,7 +15,7 @@ module type S = sig
val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_signkeys : unit -> Api.FutureSignKey.t list
val get_future_denominations : unit -> Api.FutureDenom.t list val get_future_denominations : unit -> Api.FutureDenom.t list
val find_signkey : eddsa_pub -> Signkey.t option val find_signkey : eddsa_pub -> Signkey.t option
val find_denomination : rsa_pub -> Denomination.t option val find_denomination : denom_hash -> Denomination.t option
val certify_future_signkey : val certify_future_signkey :
eddsa_pub -> eddsa_pub ->
@ -23,7 +23,7 @@ module type S = sig
(unit, string) result (unit, string) result
val certify_future_denomination : val certify_future_denomination :
rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result
val revoke_signkey : val revoke_signkey :
eddsa_pub -> eddsa_pub ->
@ -31,7 +31,7 @@ module type S = sig
(unit, string) result (unit, string) result
val revoke_denomination : val revoke_denomination :
rsa_pub -> denom_hash ->
Signatures.MasterDenominationKeyRevocation.t -> Signatures.MasterDenominationKeyRevocation.t ->
(unit, string) result (unit, string) result

1
src/signkey.ml
View file

@ -1,5 +1,6 @@
open Crypto open Crypto
(* TODO replace by Api.SignKey.t instead? (no revoked_sig) *)
type t = { type t = {
pub: eddsa_pub; pub: eddsa_pub;
stamp_start: Timestamp.t; stamp_start: Timestamp.t;