swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

+ rename

Browse source
This commit is contained in:
swrup 2026-02-21 16:45:59 +01:00
parent 84c3b8bec5
commit 5a52d309f8
5 changed files with 53 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/http_info.ml
View file

@ -173,7 +173,7 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
|> Hash.H64.hash
in
let open Signatures.ExchangeKeySet in
signf (Keys.sign ~pub:exchange_pub) R.{ list_issue_date; hc }
signf (Keys.sign exchange_pub) R.{ list_issue_date; hc }
in
let recoup = (* TODO /recoup *) [] in

27
src/keys.ml
View file

@ -8,16 +8,22 @@ module Make (Conn : Pg.CONN) = struct
open Crypto
let master_pub = Config.Exchange.master_public_key
let secmod_rsa_pub = Secmod_rsa.sm_key_pub
let secmod_eddsa_pub = Secmod_eddsa.sm_key_pub
let secmod_rsa_pub = Secmod_rsa.sm_pub
let secmod_eddsa_pub = Secmod_eddsa.sm_pub
let sign ~pub s =
Secmod_eddsa.sign ~pub s |> function
(* TODO error
should be a "key not found", either:
- we tried to sign with a key that is not ours
- key was revoked
- bad keyring state
*)
let sign pub s =
match Secmod_eddsa.sign ~pub s with
| Error e -> Fmt.failwith "sign failure: %s." e
| Ok v -> v
let sign_denom ~pub s =
Secmod_rsa.sign ~pub s |> function
let sign_denom pub s =
match Secmod_rsa.sign ~pub s with
| Error e -> Fmt.failwith "sign_denom failure: %s." e
| Ok v -> v
@ -42,8 +48,7 @@ module Make (Conn : Pg.CONN) = struct
let exchange_pub = pub in
let anchor_time = stamp_start in
let duration = Timestamp.diff stamp_start stamp_expire in
signf Secmod_eddsa.sign_with_sm_key
{ exchange_pub; anchor_time; duration }
signf Secmod_eddsa.sign_secmod { exchange_pub; anchor_time; duration }
in
Api.FutureSignKey.
{ key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
@ -90,7 +95,7 @@ module Make (Conn : Pg.CONN) = struct
let duration_withdraw =
Timestamp.diff stamp_start stamp_expire_withdraw
in
signf Secmod_rsa.sign_with_sm_key
signf Secmod_rsa.sign_secmod
{ h_denom_pub; h_section_name; anchor_time; duration_withdraw }
in
FutureDenom.
@ -268,7 +273,7 @@ module Make (Conn : Pg.CONN) = struct
match opt with
| None -> Error "signkey not found"
| Some _sk ->
let* () = Secmod_eddsa.revoke_key pub in
let* () = Secmod_eddsa.revoke pub in
let+ () =
Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_err_caqti
in
@ -280,7 +285,7 @@ module Make (Conn : Pg.CONN) = struct
| None -> Error "denomination not found"
| Some sk ->
let pub = sk.pub in
let* () = Secmod_rsa.revoke_key pub in
let* () = Secmod_rsa.revoke pub in
let+ () =
Pg.insert_denomination_revocation conn h_pub revoked_sig
|> unwrap_err_caqti

4
src/mod_intf.mli
View file

@ -6,8 +6,8 @@ module type S = sig
val master_pub : eddsa_pub
val secmod_rsa_pub : eddsa_pub
val secmod_eddsa_pub : eddsa_pub
val sign : pub:eddsa_pub -> string -> eddsa_sig
val sign_denom : pub:rsa_pub -> string -> string
val sign : eddsa_pub -> string -> eddsa_sig
val sign_denom : rsa_pub -> string -> string
val find_signkey : eddsa_pub -> Signkey.t option result
val find_denomination : denom_hash -> Denomination.t option result
val signkeys : unit -> Signkey.t list result

34
src/secmod_eddsa.ml
View file

@ -12,7 +12,7 @@ type key = {
type t = {
sm_key_priv: EddsaPrivateKey.t;
sm_key_pub: EddsaPublicKey.t;
sm_pub: EddsaPublicKey.t;
ht: (EddsaPublicKey.t, key) Hashtbl.t;
}
@ -137,10 +137,10 @@ let load () =
| [] -> Ok None
| _l ->
let* sm_key_priv = read_key sm_key_fpath in
let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
let ht = Hashtbl.create 0xff in
let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
Ok (Some { sm_key_priv; sm_key_pub; ht })
Ok (Some { sm_key_priv; sm_pub; ht })
let init () =
let* opt = load () in
@ -148,10 +148,10 @@ let init () =
match opt with
| Some t -> Ok t
| None ->
let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in
let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in
let* () = write_eddsa sm_key_fpath sm_key_priv in
let ht = Hashtbl.create 0xff in
Ok { sm_key_priv; sm_key_pub; ht }
Ok { sm_key_priv; sm_pub; ht }
in
let now = Absolute.of_ptime (Ptime_clock.now ()) in
let keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in
@ -167,25 +167,25 @@ let t =
| Error e -> Fmt.failwith "secmod_eddsa initialization failure: %s." e
| Ok t -> t
let sm_key_pub = t.sm_key_pub
let sm_pub = t.sm_pub
let keys () =
Hashtbl.to_seq_values t.ht
|> List.of_seq
|> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2))
let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s
let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
let find_key pub =
let find pub =
Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
let sign ~pub s =
let+ k = find_key pub in
let+ k = find pub in
let data = EddsaSignature.sign ~key:k.priv s in
data
let delete_key pub =
let* k = find_key pub in
let delete pub =
let* k = find pub in
Hashtbl.remove t.ht k.pub; delete_key_file k
let delete_outdated ~now =
@ -193,19 +193,19 @@ let delete_outdated ~now =
|> List.of_seq
|> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
|> List.map (fun k -> k.pub)
|> list_iter delete_key
|> list_iter delete
let add_key t1 t2 =
let add t1 t2 =
let priv, pub = EddsaPrivateKey.generate () in
let k = { priv; pub; t1; t2 } in
Hashtbl.replace t.ht k.pub k;
()
(* delete and replace *)
let revoke_key pub =
let* k = find_key pub in
let* () = delete_key pub in
add_key k.t1 k.t2; Ok ()
let revoke pub =
let* k = find pub in
let* () = delete pub in
add k.t1 k.t2; Ok ()
(* TODO
- more checks

34
src/secmod_rsa.ml
View file

@ -14,7 +14,7 @@ type key = {
type t = {
sm_key_priv: EddsaPrivateKey.t;
sm_key_pub: EddsaPublicKey.t;
sm_pub: EddsaPublicKey.t;
ht: (RsaPublicKey.t, key) Hashtbl.t;
}
@ -153,10 +153,10 @@ let load () =
| [] -> Ok None
| _l ->
let* sm_key_priv = read_eddsa sm_key_fpath in
let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
let ht = Hashtbl.create 0xff in
let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
Ok (Some { sm_key_priv; sm_key_pub; ht })
Ok (Some { sm_key_priv; sm_pub; ht })
let init () =
let* opt = load () in
@ -164,10 +164,10 @@ let init () =
match opt with
| Some t -> Ok t
| None ->
let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in
let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in
let* () = write_eddsa sm_key_fpath sm_key_priv in
let ht = Hashtbl.create 0xff in
Ok { sm_key_priv; sm_key_pub; ht }
Ok { sm_key_priv; sm_pub; ht }
in
let now = Absolute.of_ptime (Ptime_clock.now ()) in
let all_keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in
@ -193,7 +193,7 @@ let t =
| Error e -> Fmt.failwith "secmod_rsa initialization failure: %s." e
| Ok t -> t
let sm_key_pub = t.sm_key_pub
let sm_pub = t.sm_pub
let keys () =
Hashtbl.to_seq_values t.ht
@ -201,18 +201,18 @@ let keys () =
|> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
(section_name, pub, t1, t2))
let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s
let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
let find_key pub =
let find pub =
Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
let sign ~pub s =
let+ k = find_key pub in
let+ k = find pub in
let data = RsaSignature.sign ~key:k.priv s in
data
let delete_key pub =
let* k = find_key pub in
let delete pub =
let* k = find pub in
Hashtbl.remove t.ht k.pub; delete_key_file k
let delete_outdated ~now =
@ -220,17 +220,17 @@ let delete_outdated ~now =
|> List.of_seq
|> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
|> List.map (fun k -> k.pub)
|> list_iter delete_key
|> list_iter delete
let add_key section_name t1 t2 =
let add section_name t1 t2 =
let priv, pub = RsaPrivateKey.generate ~bits:Cfg.rsa_keysize () in
let k = { section_name; priv; pub; t1; t2 } in
Hashtbl.replace t.ht k.pub k;
()
(* delete and replace *)
let revoke_key pub =
let* k = find_key pub in
let* () = delete_key pub in
add_key k.section_name k.t1 k.t2;
let revoke pub =
let* k = find pub in
let* () = delete pub in
add k.section_name k.t1 k.t2;
Ok ()