From 681477e7365f5d6638ba3efce5cee504ac76dd8c Mon Sep 17 00:00:00 2001 From: swrup Date: Tue, 16 Dec 2025 14:20:41 +0100 Subject: [PATCH] JJ: Description from the destination commit: add secmod sign_with_xx JJ: Description from source commit: . --- src/bin_sig.ml | 23 +++++++++--------- src/crypto.ml | 12 +++++++-- src/http_management.ml | 55 +++++++++++++++++++----------------------- src/secmod.ml | 37 ++++++++++++++++++++++++++-- src/secmod.mli | 13 ++++++++-- tools/offline_sig.ml | 18 +++++++++----- 6 files changed, 104 insertions(+), 54 deletions(-) diff --git a/src/bin_sig.ml b/src/bin_sig.ml index 1c95cdcc..70d86584 100644 --- a/src/bin_sig.ml +++ b/src/bin_sig.ml @@ -77,13 +77,19 @@ module MK (R : sig val bin : r Bin.t end) : sig + open Crypto + type r = R.r type t - val sign : key:Crypto.EddsaPrivateKey.t -> r -> t + val sign_f : f:(string -> eddsa_sig) -> r -> t + + val verify_f : + f:(eddsa_sig -> msg:string -> (unit, string) result) -> + t -> + r -> + (unit, string) result - (* Ok () on verification success *) - val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> (unit, string) result val jsont : t Jsont.t val caqti : t Caqti_type.t end = struct @@ -92,15 +98,8 @@ end = struct type r = R.r type t = EddsaSignature.t - let bin = R.bin - let sign ~key r = EddsaSignature.sign ~key (Bin.to_string bin r) - - let verify ~key t r = - let b = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r) in - match b with - | false -> Error "signature verification failure" - | true -> Ok () - + let sign_f ~f r = f (Bin.to_string R.bin r) + let verify_f ~f t r = f t ~msg:(Bin.to_string R.bin r) let jsont = EddsaSignature.jsont let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti end diff --git a/src/crypto.ml b/src/crypto.ml index 6abf3849..b61979e4 100644 --- a/src/crypto.ml +++ b/src/crypto.ml @@ -75,7 +75,9 @@ module EddsaSignature : sig type t val sign : key:EddsaPrivateKey.t -> string -> t - val verify : key:EddsaPublicKey.t -> t -> msg:string -> bool + + (* Ok () on verification success *) + val verify : key:EddsaPublicKey.t -> t -> msg:string -> (unit, string) result val to_octets : t -> string val of_octets : string -> (t, string) result val jsont : t Jsont.t @@ -90,7 +92,13 @@ end = struct (* mirage_crypto: "The result is the concatenation of r and s, as specified in RFC 8032." *) let sign ~key s = Mirage_crypto_ec.Ed25519.sign ~key s - let verify ~key s ~msg = Mirage_crypto_ec.Ed25519.verify ~key s ~msg + + let verify ~key s ~msg = + let b = Mirage_crypto_ec.Ed25519.verify ~key s ~msg in + match b with + | false -> Error "signature verification failure: invalid signature" + | true -> Ok () + let to_octets t = t let of_octets v = diff --git a/src/http_management.ml b/src/http_management.ml index 4dde76e4..48a92b24 100644 --- a/src/http_management.ml +++ b/src/http_management.ml @@ -2,7 +2,7 @@ open Syntax open Api module Keys_get = struct - let mk_future_denom ~sm_key_priv + let mk_future_denom ~sm ({ pub; priv= _; @@ -32,7 +32,8 @@ module Keys_get = struct let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in - sign ~key:sm_key_priv + sign_f + ~f:(Secmod.sign_with_sm_key sm) { h_denom_pub; h_section_name; anchor_time; duration_withdraw } in FutureDenom. @@ -51,7 +52,7 @@ module Keys_get = struct denom_secmod_sig; } - let mk_future_signkey ~sm_signkey_priv + let mk_future_signkey ~sm ({ pub; priv= _; stamp_start; stamp_expire; stamp_end; master_sig= _ } : Signkey_data.t) = let signkey_secmod_sig = @@ -59,7 +60,9 @@ module Keys_get = struct let exchange_pub = pub in let anchor_time = stamp_start in let duration = Timestamp.diff stamp_start stamp_expire in - sign ~key:sm_signkey_priv { exchange_pub; anchor_time; duration } + sign_f + ~f:(Secmod.sign_with_sm_key sm) + { exchange_pub; anchor_time; duration } in FutureSignKey. { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig } @@ -68,16 +71,12 @@ module Keys_get = struct let future_signkeys = Secmod.get_signkeys sm |> List.filter (fun k -> Option.is_none k.Signkey_data.master_sig) - |> List.map (fun signkey -> - let sm_signkey_priv = Secmod.get_sm_key_priv sm in - mk_future_signkey ~sm_signkey_priv signkey) + |> List.map (fun signkey -> mk_future_signkey ~sm signkey) in let future_denoms = Secmod.get_denoms sm |> List.filter (fun k -> Option.is_none k.Denom_data.master_sig) - |> List.map (fun denom -> - let sm_key_priv = Secmod.get_sm_key_priv sm in - mk_future_denom ~sm_key_priv denom) + |> List.map (fun denom -> mk_future_denom ~sm denom) in let master_pub = Config.Exchange.master_public_key in let denom_secmod_public_key = Secmod.get_sm_key_pub sm in @@ -108,9 +107,7 @@ module Keys_post = struct let verify_denom_signature ~sm DenomSignature.{ h_denom_pub; master_sig } = let denom_hash = HashCode.to_denomination_hash h_denom_pub in let* denom = - Secmod.get_denoms sm - |> List.find_opt (fun (denom : Denom_data.t) -> denom.h_pub = denom_hash) - |> function + match Secmod.find_denom_data sm denom_hash with | None -> Fmt.error "404 not found, One of the keys for which a signature was provided \ @@ -132,13 +129,11 @@ module Keys_post = struct denom_hash; } in - verify ~key:Config.master_public_key master_sig r + verify_f ~f:Secmod.verify_with_master_key master_sig r let verify_signkey_signature ~sm SignKeySignature.{ key; master_sig } = let* signkey = - Secmod.get_signkeys sm - |> List.find_opt (fun (signkey : Signkey_data.t) -> signkey.pub = key) - |> function + match Secmod.find_signkey_data sm key with | None -> Fmt.error "404 not found, One of the keys for which a signature was provided \ @@ -154,7 +149,7 @@ module Keys_post = struct signkey_pub= signkey.pub; } in - verify ~key:Config.master_public_key master_sig r + verify_f ~f:Secmod.verify_with_master_key master_sig r let verify ~sm MasterSignatures.{ denom_sigs; signkey_sigs } = let* () = list_iter (verify_denom_signature ~sm) denom_sigs in @@ -226,7 +221,7 @@ end module Denom_revoke = struct let verify h_denom_pub DenomRevocationSignature.{ master_sig } = let open Bin_sig.MasterDenominationKeyRevocation in - verify ~key:Config.Exchange.master_public_key master_sig { h_denom_pub } + verify_f ~f:Secmod.verify_with_master_key master_sig { h_denom_pub } let do_ ~db_conn ~sm h_denom_pub DenomRevocationSignature.{ master_sig } = let* () = Secmod.revoke_denomination sm h_denom_pub master_sig in @@ -256,7 +251,7 @@ end module Signkey_revoke = struct let verify exchange_pub SignkeyRevocationSignature.{ master_sig } = let open Bin_sig.MasterSigningKeyRevocation in - verify ~key:Config.Exchange.master_public_key master_sig { exchange_pub } + verify_f ~f:Secmod.verify_with_master_key master_sig { exchange_pub } let do_ ~db_conn ~sm exchange_pub SignkeyRevocationSignature.{ master_sig } = let* () = Secmod.revoke_signkey sm exchange_pub master_sig in @@ -293,7 +288,7 @@ module Auditors = struct validity_start; } = let open Bin_sig.MasterAddAuditor in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { start_date= validity_start; auditor_pub; @@ -337,7 +332,7 @@ end module Auditors_disable = struct let verify auditor_pub AuditorTeardownMessage.{ master_sig; validity_end } = let open Bin_sig.MasterDelAuditor in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { end_date= validity_end; auditor_pub } let do_ ~db_conn auditor_pub @@ -384,7 +379,7 @@ module Wire_fee = struct wire_fee; } = let open Bin_sig.MasterWireFee in - verify ~key:Config.Exchange.master_public_key master_sig_wire + verify_f ~f:Secmod.verify_with_master_key master_sig_wire { h_wire_method= Bin_type.Hash_64_cstr.hash wire_method; start_date= fee_start; @@ -455,7 +450,7 @@ module Global_fees = struct let kyc_fee = dummy_amount in (* * *) let open Bin_sig.GlobalFees in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { start_date; end_date; @@ -514,7 +509,7 @@ module Wire = struct let open Bin_type in let* () = let open Bin_sig.MasterWireDetails in - verify ~key:Config.Exchange.master_public_key master_sig_wire + verify_f ~f:Secmod.verify_with_master_key master_sig_wire { h_wire_details= FullPaytoHash.hash payto_uri; h_conversion_url= Hash_64_cstr.hash conversion_url; @@ -524,7 +519,7 @@ module Wire = struct in let* () = let open Bin_sig.MasterAddWire in - verify ~key:Config.Exchange.master_public_key master_sig_add + verify_f ~f:Secmod.verify_with_master_key master_sig_add { start_date= validity_start; h_wire= FullPaytoHash.hash payto_uri; @@ -577,7 +572,7 @@ end module Wire_disable = struct let verify WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } = let open Bin_sig.MasterDelWire in - verify ~key:Config.Exchange.master_public_key master_sig_del + verify_f ~f:Secmod.verify_with_master_key master_sig_del { end_date= validity_end; h_wire= Bin_type.FullPaytoHash.hash payto_uri } let do_ ~db_conn @@ -620,7 +615,7 @@ module Drain = struct } = let open Bin_sig.MasterDrainProfit in let open Bin_type in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { wtid; date; @@ -660,7 +655,7 @@ module AmlOfficer = struct } = let open Bin_sig.MasterAmlOfficerStatus in let is_active = match is_active with true -> 1_l | false -> 0_l in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { change_date; officer_pub; @@ -699,7 +694,7 @@ module Partners = struct wad_fee; } = let open Bin_sig.PartnerConfiguration in - verify ~key:Config.Exchange.master_public_key master_sig + verify_f ~f:Secmod.verify_with_master_key master_sig { partner_pub; start_date; diff --git a/src/secmod.ml b/src/secmod.ml index 548338b6..7801e9b5 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -2,7 +2,10 @@ - key rotation - how many signkey to use? we just use 1 for now - - does the secmod's own key as metadata/expiration date? *) + - does the secmod's own key as metadata/expiration date? + - something to refer to valid sk/dn + + - eddsa.ml with phantom type for key-kind + signed-data-kind *) open Syntax open Crypto @@ -20,7 +23,31 @@ type t = { Hashtbl.t; } -let get_sm_key_priv t = t.sm_key_priv +(* note: don't expose a signing function if we want a real "security module" one day *) +let sign_with_sm_key t s = EddsaSignature.sign ~key:t.sm_key_priv s +let verify_with_sm_key t s ~msg = EddsaSignature.verify ~key:t.sm_key_pub s ~msg + +let verify_with_master_key s ~msg = + EddsaSignature.verify ~key:Config.master_public_key s ~msg + +(* TODO + - do something to force `pub` to be one of the valid signkey + how to handle revocation? + raise exn for now *) +let sign_with_signkey t ~pub s = + Miou.Mutex.protect t.lock @@ fun () -> + match Hashtbl.find_opt t.sk_ht pub with + | None -> Fmt.failwith "secmod failure: public key not found." + | Some signkey -> + let v = EddsaSignature.sign ~key:signkey.priv s in + v + +let verify_with_signkey t ~pub s ~msg = + Miou.Mutex.protect t.lock @@ fun () -> + match Hashtbl.find_opt t.sk_ht pub with + | None -> Error "secmod failure: public key not found." + | Some signkey -> EddsaSignature.verify ~key:signkey.pub s ~msg + let get_sm_key_pub t = t.sm_key_pub let get_signkeys t = @@ -31,6 +58,12 @@ let get_denoms t = Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.to_seq_values t.dn_ht |> List.of_seq +let find_signkey_data t pub = + Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.sk_ht pub + +let find_denom_data t h_denom = + Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.dn_ht h_denom + let add_signkey_master_signatures conn t l = Miou.Mutex.protect t.lock @@ fun () -> list_iter diff --git a/src/secmod.mli b/src/secmod.mli index ba897b50..7868cb6b 100644 --- a/src/secmod.mli +++ b/src/secmod.mli @@ -2,13 +2,22 @@ open Crypto type t -val get_sm_key_priv : t -> eddsa_priv +val sign_with_sm_key : t -> string -> eddsa_sig +val sign_with_signkey : t -> pub:eddsa_pub -> string -> eddsa_sig +val verify_with_master_key : eddsa_sig -> msg:string -> (unit, string) result +val verify_with_sm_key : t -> eddsa_sig -> msg:string -> (unit, string) result + +val verify_with_signkey : + t -> pub:eddsa_pub -> eddsa_sig -> msg:string -> (unit, string) result + val get_sm_key_pub : t -> eddsa_pub val get_signkeys : t -> Signkey_data.t list val get_denoms : t -> Denom_data.t list -val init : (module Pg.CONN) -> t +val find_signkey_data : t -> eddsa_pub -> Signkey_data.t option +val find_denom_data : t -> denomination_hash -> Denom_data.t option (* - management operations - *) +val init : (module Pg.CONN) -> t val add_signkey_master_signatures : (module Pg.CONN) -> diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml index 580cb809..7c442251 100644 --- a/tools/offline_sig.ml +++ b/tools/offline_sig.ml @@ -24,7 +24,8 @@ let denom_signature ~master_key let open Bin_sig.DenominationKeyValidity in let master = EddsaPrivateKey.(pub_of_priv master_key) in let denom_hash = DenominationHash.hash octets in - sign ~key:master_key + sign_f + ~f:(EddsaSignature.sign ~key:master_key) { master; start= stamp_start; @@ -45,7 +46,8 @@ let signkey_signature ~master_key { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } = let master_sig = let open Bin_sig.ExchangeSigningKeyValidity in - sign ~key:master_key + sign_f + ~f:(EddsaSignature.sign ~key:master_key) { start= stamp_start; expire= stamp_expire; @@ -77,7 +79,9 @@ let verify_future_signkey ~sm_signkey_pub let anchor_time = stamp_start in let duration = Timestamp.diff stamp_start stamp_expire in let open Bin_sig.SigningKeyAnnouncement in - verify ~key:sm_signkey_pub signkey_secmod_sig + verify_f + ~f:(EddsaSignature.verify ~key:sm_signkey_pub) + signkey_secmod_sig { exchange_pub; anchor_time; duration } let verify_future_denom ~sm_denom_pub @@ -103,7 +107,9 @@ let verify_future_denom ~sm_denom_pub let anchor_time = stamp_start in let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in let open Bin_sig.DenominationKeyAnnouncement in - verify ~key:sm_denom_pub denom_secmod_sig + verify_f + ~f:(EddsaSignature.verify ~key:sm_denom_pub) + denom_secmod_sig { h_denom_pub; h_section_name; anchor_time; duration_withdraw } let verify_future_keys_response our_master_public_key @@ -138,13 +144,13 @@ let verify_future_keys_response our_master_public_key let mk_denom_revoke ~key h_denom_pub = let master_sig = let open Bin_sig.MasterDenominationKeyRevocation in - sign ~key { h_denom_pub } + sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub } in DenomRevocationSignature.{ master_sig } let mk_signkey_revoke ~key exchange_pub = let master_sig = let open Bin_sig.MasterSigningKeyRevocation in - sign ~key { exchange_pub } + sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub } in SignkeyRevocationSignature.{ master_sig }