fix secmod_rsa config; fix signkey stamp_end

src/config.ml

@@ -188,25 +188,8 @@ module Exchange_secmod_rsa = struct
 
   let lookahead_sign = get "lookahead_sign" |> duration
   let overlap_duration = get "overlap_duration" |> duration
-  let duration = get "duration" |> duration
   let key_dir = get "key_dir"
   let sm_priv_key = get "sm_priv_key"
-
-  (* only support one rsa_keysize *)
-  let rsa_keysize =
-    Coin.all_coins
-    |> List.map (fun coin -> coin.Coin.rsa_keysize)
-    |> List.sort_uniq Int.compare
-    |> function
-    | [] -> fail "no coin section found"
-    | a :: b :: _ ->
-        fail
-          "coins with different rsa_keysize are not supported, found \
-           rsa_keysize = %d and %d"
-          a b
-    | n :: [] -> n
-
-  let sections = Coin.all_coins |> List.map (fun coin -> coin.Coin.section_name)
 end
 
 module Exchange_secmod_eddsa = struct

src/keys.ml

@@ -62,11 +62,13 @@ module Make (Conn : Pg.CONN) : S = struct
 
   let denominations () = Pg.get_denominations conn () |> unwrap_err_caqti
 
-  (* TODO check stamps definitions *)
   let make_future_sk ~pub ~start ~expire =
     let stamp_start = Timestamp.of_absolute start in
     let stamp_expire = Timestamp.of_absolute expire in
-    let stamp_end = stamp_expire in
+    let stamp_end =
+      Timestamp.of_absolute
+      @@ Time.Absolute.add start Config.Exchange.signkey_legal_duration
+    in
     let signkey_secmod_sig =
       let open Signatures.SigningKeyAnnouncement in
       let exchange_pub = pub in
@@ -113,14 +115,13 @@ module Make (Conn : Pg.CONN) : S = struct
     let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
     let denom_secmod_sig =
       let open Signatures.DenominationKeyAnnouncement in
-      let h_denom_pub = h_pub in
-      let h_section_name = Hash.Cstring.H64.hash section_name in
-      let anchor_time = stamp_start in
-      let duration_withdraw =
-        Timestamp.diff stamp_start stamp_expire_withdraw
-      in
       signf Sm_rsa.sign_secmod
-        { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
+        {
+          h_denom_pub= h_pub;
+          h_section_name= Hash.Cstring.H64.hash section_name;
+          anchor_time= stamp_start;
+          duration_withdraw= Timestamp.diff stamp_start stamp_expire_withdraw;
+        }
     in
     FutureDenom.
       {
@@ -162,9 +163,8 @@ module Make (Conn : Pg.CONN) : S = struct
   let future_denominations () =
     let+ l =
       list_map
-        (fun (section_name, pub, t1, _t2) ->
+        (fun (section_name, pub, t1) ->
           let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
-          (*?? let duration_withdraw = Time.Absolute.diff t1 t2 in*)
           let* opt = find_denomination h_pub in
           match opt with
           | None ->
@@ -278,12 +278,12 @@ module Make (Conn : Pg.CONN) : S = struct
 
   let certify_future_denomination h_pub master_sig =
     Sm_rsa.keys ()
-    |> List.find_opt (fun (_section_name, pub, _t1, _t2) ->
+    |> List.find_opt (fun (_section_name, pub, _t1) ->
         let h_pub' = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
         h_pub' = h_pub)
     |> function
     | None -> Error "future denomination not found"
-    | Some (section_name, pub, t1, _t2) ->
+    | Some (section_name, pub, t1) ->
         let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
         let* () =
           let* opt = find_denomination h_pub in

src/secmod_eddsa.ml

@@ -234,12 +234,4 @@ end
   - sign: check timestamps before signing
   - schedule tasks
   - !lock
-
-  taler doc/config is confusing
-  how is computed stamp_expire stamp_end
-  what to do of 'Exchange.signkey_legal_duration'
-  =>
-    stamp_expire = stamp_start + duration
-    stamp_end = stamp_start + signkey_legal_duration
-    (not sure about it)
 *)

src/secmod_rsa.ml

@@ -1,4 +1,6 @@
-(* TODO refacto common parts with secmod_eddsa *)
+(* TODO
+   refacto common parts with secmod_eddsa
+   use DenominationHash.t instead of rsa_pub? *)
 let src = Logs.Src.create "mte.secmod_rsa"
 
 module Log = (val Logs.src_log src : Logs.LOG)
@@ -7,7 +9,37 @@ module Log = (val Logs.src_log src : Logs.LOG)
 open Syntax
 open Crypto
 open Time
-module Cfg = Config.Exchange_secmod_rsa
+
+module Cfg = struct
+  open Config
+  include Exchange_secmod_rsa
+
+  let sections = Coin.all_coins |> List.map (fun coin -> coin.Coin.section_name)
+
+  (* helper functions to get config value from section_name: *)
+
+  let duration_withdraw =
+    let duration_withdraw_assoc =
+      Coin.all_coins
+      |> List.map (fun coin -> (coin.Coin.section_name, coin.duration_withdraw))
+    in
+    fun ~section_name ->
+      match List.assoc_opt section_name duration_withdraw_assoc with
+      | None ->
+          Fmt.failwith "section_name `%s` not found in config" section_name
+      | Some v -> v
+
+  let rsa_keysize =
+    let rsa_keysize_assoc =
+      Coin.all_coins
+      |> List.map (fun coin -> (coin.Coin.section_name, coin.rsa_keysize))
+    in
+    fun ~section_name ->
+      match List.assoc_opt section_name rsa_keysize_assoc with
+      | None ->
+          Fmt.failwith "section_name `%s` not found in config" section_name
+      | Some v -> v
+end
 
 type key = {
   section_name: string;
@@ -92,8 +124,9 @@ let get_key_dir_contents dir_fpath =
 
 (* -- *)
 
-let gen_key section_name t1 t2 =
+let gen_key ~section_name t1 t2 =
-  let priv, pub = RsaPrivateKey.generate ~bits:Cfg.rsa_keysize () in
+  let bits = Cfg.rsa_keysize ~section_name in
+  let priv, pub = RsaPrivateKey.generate ~bits () in
   Log.debug (fun m ->
       m "generated key (%s-%s):@,`%s`" (time_abs_to_string t1)
         (time_abs_to_string t2) (RsaPublicKey.to_b32 pub));
@@ -101,16 +134,16 @@ let gen_key section_name t1 t2 =
 
 let sort_keys l = List.sort (fun a b -> Absolute.compare a.t2 b.t2) l
 
-let split_in_periodes ~start ~end_ =
+let split_in_periodes ~start ~end_ ~duration_withdraw =
   assert (start < end_);
   (* no overlap on first periode *)
   let t1 = start in
-  let t2 = Absolute.add start Cfg.duration in
+  let t2 = Absolute.add start duration_withdraw in
   let acc = [ (t1, t2) ] in
   let start = t2 in
   let rec go acc start end_ =
     let t1 = Absolute.sub start Cfg.overlap_duration in
-    let t2 = Absolute.add start Cfg.duration in
+    let t2 = Absolute.add start duration_withdraw in
     if t2 > end_ then acc else go ((t1, t2) :: acc) t2 end_
   in
   go acc start end_
@@ -126,9 +159,10 @@ let gen_additional_keys_until_lookahead ~now ~section_name l =
   let end_ = Absolute.add now Cfg.lookahead_sign in
   if Absolute.compare start end_ >= 0 then []
   else
-    let periodes = split_in_periodes ~start ~end_ in
+    let duration_withdraw = Cfg.duration_withdraw ~section_name in
+    let periodes = split_in_periodes ~start ~end_ ~duration_withdraw in
     let new_keys =
-      List.map (fun (t1, t2) -> gen_key section_name t1 t2) periodes
+      List.map (fun (t1, t2) -> gen_key ~section_name t1 t2) periodes
     in
     new_keys
 
@@ -227,7 +261,7 @@ module Make () = struct
     |> list_iter delete
 
   let add section_name t1 t2 =
-    let k = gen_key section_name t1 t2 in
+    let k = gen_key ~section_name t1 t2 in
     Hashtbl.replace t.ht k.pub k;
     ()
 
@@ -236,8 +270,8 @@ module Make () = struct
   let keys () =
     Hashtbl.to_seq_values t.ht
     |> List.of_seq
-    |> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
+    |> List.map (fun { section_name; priv= _; pub; t1; t2= _ } ->
-        (section_name, pub, t1, t2))
+        (section_name, pub, t1))
 
   let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s