From 5a52d309f8143204a68824a75ffc2f3323397584 Mon Sep 17 00:00:00 2001 From: swrup Date: Sat, 21 Feb 2026 16:45:59 +0100 Subject: [PATCH] + rename --- src/http_info.ml | 2 +- src/keys.ml | 27 ++++++++++++++++----------- src/mod_intf.mli | 4 ++-- src/secmod_eddsa.ml | 34 +++++++++++++++++----------------- src/secmod_rsa.ml | 34 +++++++++++++++++----------------- 5 files changed, 53 insertions(+), 48 deletions(-) diff --git a/src/http_info.ml b/src/http_info.ml index d0453d6b..9f2f73d9 100644 --- a/src/http_info.ml +++ b/src/http_info.ml @@ -173,7 +173,7 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date = |> Hash.H64.hash in let open Signatures.ExchangeKeySet in - signf (Keys.sign ~pub:exchange_pub) R.{ list_issue_date; hc } + signf (Keys.sign exchange_pub) R.{ list_issue_date; hc } in let recoup = (* TODO /recoup *) [] in diff --git a/src/keys.ml b/src/keys.ml index ef587b4b..138c5160 100644 --- a/src/keys.ml +++ b/src/keys.ml @@ -8,16 +8,22 @@ module Make (Conn : Pg.CONN) = struct open Crypto let master_pub = Config.Exchange.master_public_key - let secmod_rsa_pub = Secmod_rsa.sm_key_pub - let secmod_eddsa_pub = Secmod_eddsa.sm_key_pub + let secmod_rsa_pub = Secmod_rsa.sm_pub + let secmod_eddsa_pub = Secmod_eddsa.sm_pub - let sign ~pub s = - Secmod_eddsa.sign ~pub s |> function + (* TODO error + should be a "key not found", either: + - we tried to sign with a key that is not ours + - key was revoked + - bad keyring state + *) + let sign pub s = + match Secmod_eddsa.sign ~pub s with | Error e -> Fmt.failwith "sign failure: %s." e | Ok v -> v - let sign_denom ~pub s = - Secmod_rsa.sign ~pub s |> function + let sign_denom pub s = + match Secmod_rsa.sign ~pub s with | Error e -> Fmt.failwith "sign_denom failure: %s." e | Ok v -> v @@ -42,8 +48,7 @@ module Make (Conn : Pg.CONN) = struct let exchange_pub = pub in let anchor_time = stamp_start in let duration = Timestamp.diff stamp_start stamp_expire in - signf Secmod_eddsa.sign_with_sm_key - { exchange_pub; anchor_time; duration } + signf Secmod_eddsa.sign_secmod { exchange_pub; anchor_time; duration } in Api.FutureSignKey. { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig } @@ -90,7 +95,7 @@ module Make (Conn : Pg.CONN) = struct let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in - signf Secmod_rsa.sign_with_sm_key + signf Secmod_rsa.sign_secmod { h_denom_pub; h_section_name; anchor_time; duration_withdraw } in FutureDenom. @@ -268,7 +273,7 @@ module Make (Conn : Pg.CONN) = struct match opt with | None -> Error "signkey not found" | Some _sk -> - let* () = Secmod_eddsa.revoke_key pub in + let* () = Secmod_eddsa.revoke pub in let+ () = Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_err_caqti in @@ -280,7 +285,7 @@ module Make (Conn : Pg.CONN) = struct | None -> Error "denomination not found" | Some sk -> let pub = sk.pub in - let* () = Secmod_rsa.revoke_key pub in + let* () = Secmod_rsa.revoke pub in let+ () = Pg.insert_denomination_revocation conn h_pub revoked_sig |> unwrap_err_caqti diff --git a/src/mod_intf.mli b/src/mod_intf.mli index 162503fd..70571160 100644 --- a/src/mod_intf.mli +++ b/src/mod_intf.mli @@ -6,8 +6,8 @@ module type S = sig val master_pub : eddsa_pub val secmod_rsa_pub : eddsa_pub val secmod_eddsa_pub : eddsa_pub - val sign : pub:eddsa_pub -> string -> eddsa_sig - val sign_denom : pub:rsa_pub -> string -> string + val sign : eddsa_pub -> string -> eddsa_sig + val sign_denom : rsa_pub -> string -> string val find_signkey : eddsa_pub -> Signkey.t option result val find_denomination : denom_hash -> Denomination.t option result val signkeys : unit -> Signkey.t list result diff --git a/src/secmod_eddsa.ml b/src/secmod_eddsa.ml index 21564eea..493c4c9c 100644 --- a/src/secmod_eddsa.ml +++ b/src/secmod_eddsa.ml @@ -12,7 +12,7 @@ type key = { type t = { sm_key_priv: EddsaPrivateKey.t; - sm_key_pub: EddsaPublicKey.t; + sm_pub: EddsaPublicKey.t; ht: (EddsaPublicKey.t, key) Hashtbl.t; } @@ -137,10 +137,10 @@ let load () = | [] -> Ok None | _l -> let* sm_key_priv = read_key sm_key_fpath in - let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in + let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in let ht = Hashtbl.create 0xff in let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in - Ok (Some { sm_key_priv; sm_key_pub; ht }) + Ok (Some { sm_key_priv; sm_pub; ht }) let init () = let* opt = load () in @@ -148,10 +148,10 @@ let init () = match opt with | Some t -> Ok t | None -> - let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in + let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in let* () = write_eddsa sm_key_fpath sm_key_priv in let ht = Hashtbl.create 0xff in - Ok { sm_key_priv; sm_key_pub; ht } + Ok { sm_key_priv; sm_pub; ht } in let now = Absolute.of_ptime (Ptime_clock.now ()) in let keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in @@ -167,25 +167,25 @@ let t = | Error e -> Fmt.failwith "secmod_eddsa initialization failure: %s." e | Ok t -> t -let sm_key_pub = t.sm_key_pub +let sm_pub = t.sm_pub let keys () = Hashtbl.to_seq_values t.ht |> List.of_seq |> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2)) -let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s +let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s -let find_key pub = +let find pub = Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found" let sign ~pub s = - let+ k = find_key pub in + let+ k = find pub in let data = EddsaSignature.sign ~key:k.priv s in data -let delete_key pub = - let* k = find_key pub in +let delete pub = + let* k = find pub in Hashtbl.remove t.ht k.pub; delete_key_file k let delete_outdated ~now = @@ -193,19 +193,19 @@ let delete_outdated ~now = |> List.of_seq |> List.filter (fun k -> Absolute.compare now k.t2 >= 0) |> List.map (fun k -> k.pub) - |> list_iter delete_key + |> list_iter delete -let add_key t1 t2 = +let add t1 t2 = let priv, pub = EddsaPrivateKey.generate () in let k = { priv; pub; t1; t2 } in Hashtbl.replace t.ht k.pub k; () (* delete and replace *) -let revoke_key pub = - let* k = find_key pub in - let* () = delete_key pub in - add_key k.t1 k.t2; Ok () +let revoke pub = + let* k = find pub in + let* () = delete pub in + add k.t1 k.t2; Ok () (* TODO - more checks diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml index 8da46ee9..bda3a0b0 100644 --- a/src/secmod_rsa.ml +++ b/src/secmod_rsa.ml @@ -14,7 +14,7 @@ type key = { type t = { sm_key_priv: EddsaPrivateKey.t; - sm_key_pub: EddsaPublicKey.t; + sm_pub: EddsaPublicKey.t; ht: (RsaPublicKey.t, key) Hashtbl.t; } @@ -153,10 +153,10 @@ let load () = | [] -> Ok None | _l -> let* sm_key_priv = read_eddsa sm_key_fpath in - let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in + let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in let ht = Hashtbl.create 0xff in let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in - Ok (Some { sm_key_priv; sm_key_pub; ht }) + Ok (Some { sm_key_priv; sm_pub; ht }) let init () = let* opt = load () in @@ -164,10 +164,10 @@ let init () = match opt with | Some t -> Ok t | None -> - let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in + let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in let* () = write_eddsa sm_key_fpath sm_key_priv in let ht = Hashtbl.create 0xff in - Ok { sm_key_priv; sm_key_pub; ht } + Ok { sm_key_priv; sm_pub; ht } in let now = Absolute.of_ptime (Ptime_clock.now ()) in let all_keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in @@ -193,7 +193,7 @@ let t = | Error e -> Fmt.failwith "secmod_rsa initialization failure: %s." e | Ok t -> t -let sm_key_pub = t.sm_key_pub +let sm_pub = t.sm_pub let keys () = Hashtbl.to_seq_values t.ht @@ -201,18 +201,18 @@ let keys () = |> List.map (fun { section_name; priv= _; pub; t1; t2 } -> (section_name, pub, t1, t2)) -let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s +let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s -let find_key pub = +let find pub = Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found" let sign ~pub s = - let+ k = find_key pub in + let+ k = find pub in let data = RsaSignature.sign ~key:k.priv s in data -let delete_key pub = - let* k = find_key pub in +let delete pub = + let* k = find pub in Hashtbl.remove t.ht k.pub; delete_key_file k let delete_outdated ~now = @@ -220,17 +220,17 @@ let delete_outdated ~now = |> List.of_seq |> List.filter (fun k -> Absolute.compare now k.t2 >= 0) |> List.map (fun k -> k.pub) - |> list_iter delete_key + |> list_iter delete -let add_key section_name t1 t2 = +let add section_name t1 t2 = let priv, pub = RsaPrivateKey.generate ~bits:Cfg.rsa_keysize () in let k = { section_name; priv; pub; t1; t2 } in Hashtbl.replace t.ht k.pub k; () (* delete and replace *) -let revoke_key pub = - let* k = find_key pub in - let* () = delete_key pub in - add_key k.section_name k.t1 k.t2; +let revoke pub = + let* k = find pub in + let* () = delete pub in + add k.section_name k.t1 k.t2; Ok ()