From 620cdf418459a1af2b2ee412a8df1afd2ae83754 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Sat, 14 Mar 2026 20:02:03 +0100
Subject: [PATCH]

---
 src/crypto.ml     | 19 ++++++++++++++++++-
 src/fdh_rsa.ml    | 11 -----------
 src/secmod_rsa.ml |  2 +-
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/src/crypto.ml b/src/crypto.ml
index 5c480085..a18f1ce7 100644
--- a/src/crypto.ml
+++ b/src/crypto.ml
@@ -247,9 +247,26 @@ module RsaPrivateKey = struct
     Jsont.of_of_string ~kind:"RsaPrivateKey" of_b32 ~enc:to_b32
 end
 
-module RsaSignature = struct
+module RsaSignature : sig
+  type t
+
+  val sign : key:RsaPrivateKey.t -> string -> t
+  val jsont : t Jsont.t
+end = struct
   type t = string
 
+  (* decrypt <=> sign *)
+  let sign ~key bmsg =
+    Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
+
+  let verify ~key s ~msg =
+    let msg_fdh = Fdh_rsa.rsa_full_domain_hash key msg in
+    let s1 = Mirage_crypto_pk.Z_extra.to_octets_be msg_fdh in
+    let s2 = Mirage_crypto_pk.Rsa.encrypt ~key s in
+    match Eqaf.equal s1 s2 with
+    | false -> Fmt.error "RSA signature verification failed"
+    | true -> Ok ()
+
   let jsont =
     let of_b32 s = B32.decode s in
     let to_b32 t = B32.encode t in
diff --git a/src/fdh_rsa.ml b/src/fdh_rsa.ml
index 87df2883..f7178e23 100644
--- a/src/fdh_rsa.ml
+++ b/src/fdh_rsa.ml
@@ -71,14 +71,3 @@ let unblind_sig pub ~bks bsig =
   in
   let data = Z.rem (Z.mul data r_inv) pub.n in
   Z_extra.to_octets_be data
-
-(* decrypt <=> sign *)
-let sign ~key bmsg = Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
-
-let verify ~key s ~msg =
-  let msg_fdh = rsa_full_domain_hash key msg in
-  let s1 = Z_extra.to_octets_be msg_fdh in
-  let s2 = Mirage_crypto_pk.Rsa.encrypt ~key s in
-  match Eqaf.equal s1 s2 with
-  | false -> Fmt.error "RSA signature verification failed"
-  | true -> Ok ()
diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml
index bd9c71ec..0fde4fc4 100644
--- a/src/secmod_rsa.ml
+++ b/src/secmod_rsa.ml
@@ -268,7 +268,7 @@ module Make (Fs : Fat.FS) = struct
 
   let sign h_pub msg =
     let+ k = find h_pub in
-    let data = Fdh_rsa.sign ~key:k.priv msg in
+    let data = RsaSignature.sign ~key:k.priv msg in
     data
 
   let revoke h_pub =