JJ: Description from the destination commit:

add secmod sign_with_xx

JJ: Description from source commit:
.

src/bin_sig.ml

@@ -77,13 +77,19 @@ module MK (R : sig
 
   val bin : r Bin.t
 end) : sig
+  open Crypto
+
   type r = R.r
   type t
 
-  val sign : key:Crypto.EddsaPrivateKey.t -> r -> t
+  val sign_f : f:(string -> eddsa_sig) -> r -> t
+
+  val verify_f :
+    f:(eddsa_sig -> msg:string -> (unit, string) result) ->
+    t ->
+    r ->
+    (unit, string) result
 
-  (* Ok () on verification success *)
-  val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> (unit, string) result
   val jsont : t Jsont.t
   val caqti : t Caqti_type.t
 end = struct
@@ -92,15 +98,8 @@ end = struct
   type r = R.r
   type t = EddsaSignature.t
 
-  let bin = R.bin
+  let sign_f ~f r = f (Bin.to_string R.bin r)
-  let sign ~key r = EddsaSignature.sign ~key (Bin.to_string bin r)
+  let verify_f ~f t r = f t ~msg:(Bin.to_string R.bin r)
-
-  let verify ~key t r =
-    let b = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r) in
-    match b with
-    | false -> Error "signature verification failure"
-    | true -> Ok ()
-
   let jsont = EddsaSignature.jsont
   let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti
 end

src/crypto.ml

@@ -75,7 +75,9 @@ module EddsaSignature : sig
   type t
 
   val sign : key:EddsaPrivateKey.t -> string -> t
-  val verify : key:EddsaPublicKey.t -> t -> msg:string -> bool
+
+  (* Ok () on verification success *)
+  val verify : key:EddsaPublicKey.t -> t -> msg:string -> (unit, string) result
   val to_octets : t -> string
   val of_octets : string -> (t, string) result
   val jsont : t Jsont.t
@@ -90,7 +92,13 @@ end = struct
 
   (* mirage_crypto: "The result is the concatenation of r and s, as specified in RFC 8032." *)
   let sign ~key s = Mirage_crypto_ec.Ed25519.sign ~key s
-  let verify ~key s ~msg = Mirage_crypto_ec.Ed25519.verify ~key s ~msg
+
+  let verify ~key s ~msg =
+    let b = Mirage_crypto_ec.Ed25519.verify ~key s ~msg in
+    match b with
+    | false -> Error "signature verification failure: invalid signature"
+    | true -> Ok ()
+
   let to_octets t = t
 
   let of_octets v =

src/http_management.ml

@@ -2,7 +2,7 @@ open Syntax
 open Api
 
 module Keys_get = struct
-  let mk_future_denom ~sm_key_priv
+  let mk_future_denom ~sm
       ({
          pub;
          priv= _;
@@ -32,7 +32,8 @@ module Keys_get = struct
       let duration_withdraw =
         Timestamp.diff stamp_start stamp_expire_withdraw
       in
-      sign ~key:sm_key_priv
+      sign_f
+        ~f:(Secmod.sign_with_sm_key sm)
         { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
     in
     FutureDenom.
@@ -51,7 +52,7 @@ module Keys_get = struct
         denom_secmod_sig;
       }
 
-  let mk_future_signkey ~sm_signkey_priv
+  let mk_future_signkey ~sm
       ({ pub; priv= _; stamp_start; stamp_expire; stamp_end; master_sig= _ } :
         Signkey_data.t) =
     let signkey_secmod_sig =
@@ -59,7 +60,9 @@ module Keys_get = struct
       let exchange_pub = pub in
       let anchor_time = stamp_start in
       let duration = Timestamp.diff stamp_start stamp_expire in
-      sign ~key:sm_signkey_priv { exchange_pub; anchor_time; duration }
+      sign_f
+        ~f:(Secmod.sign_with_sm_key sm)
+        { exchange_pub; anchor_time; duration }
     in
     FutureSignKey.
       { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
@@ -68,16 +71,12 @@ module Keys_get = struct
     let future_signkeys =
       Secmod.get_signkeys sm
       |> List.filter (fun k -> Option.is_none k.Signkey_data.master_sig)
-      |> List.map (fun signkey ->
+      |> List.map (fun signkey -> mk_future_signkey ~sm signkey)
-          let sm_signkey_priv = Secmod.get_sm_key_priv sm in
-          mk_future_signkey ~sm_signkey_priv signkey)
     in
     let future_denoms =
       Secmod.get_denoms sm
       |> List.filter (fun k -> Option.is_none k.Denom_data.master_sig)
-      |> List.map (fun denom ->
+      |> List.map (fun denom -> mk_future_denom ~sm denom)
-          let sm_key_priv = Secmod.get_sm_key_priv sm in
-          mk_future_denom ~sm_key_priv denom)
     in
     let master_pub = Config.Exchange.master_public_key in
     let denom_secmod_public_key = Secmod.get_sm_key_pub sm in
@@ -108,9 +107,7 @@ module Keys_post = struct
   let verify_denom_signature ~sm DenomSignature.{ h_denom_pub; master_sig } =
     let denom_hash = HashCode.to_denomination_hash h_denom_pub in
     let* denom =
-      Secmod.get_denoms sm
+      match Secmod.find_denom_data sm denom_hash with
-      |> List.find_opt (fun (denom : Denom_data.t) -> denom.h_pub = denom_hash)
-      |> function
       | None ->
           Fmt.error
             "404 not found, One of the keys for which a signature was provided \
@@ -132,13 +129,11 @@ module Keys_post = struct
         denom_hash;
       }
     in
-    verify ~key:Config.master_public_key master_sig r
+    verify_f ~f:Secmod.verify_with_master_key master_sig r
 
   let verify_signkey_signature ~sm SignKeySignature.{ key; master_sig } =
     let* signkey =
-      Secmod.get_signkeys sm
+      match Secmod.find_signkey_data sm key with
-      |> List.find_opt (fun (signkey : Signkey_data.t) -> signkey.pub = key)
-      |> function
       | None ->
           Fmt.error
             "404 not found, One of the keys for which a signature was provided \
@@ -154,7 +149,7 @@ module Keys_post = struct
         signkey_pub= signkey.pub;
       }
     in
-    verify ~key:Config.master_public_key master_sig r
+    verify_f ~f:Secmod.verify_with_master_key master_sig r
 
   let verify ~sm MasterSignatures.{ denom_sigs; signkey_sigs } =
     let* () = list_iter (verify_denom_signature ~sm) denom_sigs in
@@ -226,7 +221,7 @@ end
 module Denom_revoke = struct
   let verify h_denom_pub DenomRevocationSignature.{ master_sig } =
     let open Bin_sig.MasterDenominationKeyRevocation in
-    verify ~key:Config.Exchange.master_public_key master_sig { h_denom_pub }
+    verify_f ~f:Secmod.verify_with_master_key master_sig { h_denom_pub }
 
   let do_ ~db_conn ~sm h_denom_pub DenomRevocationSignature.{ master_sig } =
     let* () = Secmod.revoke_denomination sm h_denom_pub master_sig in
@@ -256,7 +251,7 @@ end
 module Signkey_revoke = struct
   let verify exchange_pub SignkeyRevocationSignature.{ master_sig } =
     let open Bin_sig.MasterSigningKeyRevocation in
-    verify ~key:Config.Exchange.master_public_key master_sig { exchange_pub }
+    verify_f ~f:Secmod.verify_with_master_key master_sig { exchange_pub }
 
   let do_ ~db_conn ~sm exchange_pub SignkeyRevocationSignature.{ master_sig } =
     let* () = Secmod.revoke_signkey sm exchange_pub master_sig in
@@ -293,7 +288,7 @@ module Auditors = struct
           validity_start;
         } =
     let open Bin_sig.MasterAddAuditor in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       {
         start_date= validity_start;
         auditor_pub;
@@ -337,7 +332,7 @@ end
 module Auditors_disable = struct
   let verify auditor_pub AuditorTeardownMessage.{ master_sig; validity_end } =
     let open Bin_sig.MasterDelAuditor in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       { end_date= validity_end; auditor_pub }
 
   let do_ ~db_conn auditor_pub
@@ -384,7 +379,7 @@ module Wire_fee = struct
           wire_fee;
         } =
     let open Bin_sig.MasterWireFee in
-    verify ~key:Config.Exchange.master_public_key master_sig_wire
+    verify_f ~f:Secmod.verify_with_master_key master_sig_wire
       {
         h_wire_method= Bin_type.Hash_64_cstr.hash wire_method;
         start_date= fee_start;
@@ -455,7 +450,7 @@ module Global_fees = struct
     let kyc_fee = dummy_amount in
     (* * *)
     let open Bin_sig.GlobalFees in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       {
         start_date;
         end_date;
@@ -514,7 +509,7 @@ module Wire = struct
     let open Bin_type in
     let* () =
       let open Bin_sig.MasterWireDetails in
-      verify ~key:Config.Exchange.master_public_key master_sig_wire
+      verify_f ~f:Secmod.verify_with_master_key master_sig_wire
         {
           h_wire_details= FullPaytoHash.hash payto_uri;
           h_conversion_url= Hash_64_cstr.hash conversion_url;
@@ -524,7 +519,7 @@ module Wire = struct
     in
     let* () =
       let open Bin_sig.MasterAddWire in
-      verify ~key:Config.Exchange.master_public_key master_sig_add
+      verify_f ~f:Secmod.verify_with_master_key master_sig_add
         {
           start_date= validity_start;
           h_wire= FullPaytoHash.hash payto_uri;
@@ -577,7 +572,7 @@ end
 module Wire_disable = struct
   let verify WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } =
     let open Bin_sig.MasterDelWire in
-    verify ~key:Config.Exchange.master_public_key master_sig_del
+    verify_f ~f:Secmod.verify_with_master_key master_sig_del
       { end_date= validity_end; h_wire= Bin_type.FullPaytoHash.hash payto_uri }
 
   let do_ ~db_conn
@@ -620,7 +615,7 @@ module Drain = struct
         } =
     let open Bin_sig.MasterDrainProfit in
     let open Bin_type in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       {
         wtid;
         date;
@@ -660,7 +655,7 @@ module AmlOfficer = struct
         } =
     let open Bin_sig.MasterAmlOfficerStatus in
     let is_active = match is_active with true -> 1_l | false -> 0_l in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       {
         change_date;
         officer_pub;
@@ -699,7 +694,7 @@ module Partners = struct
           wad_fee;
         } =
     let open Bin_sig.PartnerConfiguration in
-    verify ~key:Config.Exchange.master_public_key master_sig
+    verify_f ~f:Secmod.verify_with_master_key master_sig
       {
         partner_pub;
         start_date;

src/secmod.ml

@@ -2,7 +2,10 @@
    - key rotation
    - how many signkey to use?
      we just use 1 for now
-   - does the secmod's own key as metadata/expiration date? *)
+   - does the secmod's own key as metadata/expiration date?
+   - something to refer to valid sk/dn
+
+   - eddsa.ml with phantom type for key-kind + signed-data-kind *)
 open Syntax
 open Crypto
 
@@ -20,7 +23,31 @@ type t = {
     Hashtbl.t;
 }
 
-let get_sm_key_priv t = t.sm_key_priv
+(* note: don't expose a signing function if we want a real "security module" one day *)
+let sign_with_sm_key t s = EddsaSignature.sign ~key:t.sm_key_priv s
+let verify_with_sm_key t s ~msg = EddsaSignature.verify ~key:t.sm_key_pub s ~msg
+
+let verify_with_master_key s ~msg =
+  EddsaSignature.verify ~key:Config.master_public_key s ~msg
+
+(* TODO
+   - do something to force `pub` to be one of the valid signkey
+     how to handle revocation?
+   raise exn for now *)
+let sign_with_signkey t ~pub s =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  match Hashtbl.find_opt t.sk_ht pub with
+  | None -> Fmt.failwith "secmod failure: public key not found."
+  | Some signkey ->
+      let v = EddsaSignature.sign ~key:signkey.priv s in
+      v
+
+let verify_with_signkey t ~pub s ~msg =
+  Miou.Mutex.protect t.lock @@ fun () ->
+  match Hashtbl.find_opt t.sk_ht pub with
+  | None -> Error "secmod failure: public key not found."
+  | Some signkey -> EddsaSignature.verify ~key:signkey.pub s ~msg
+
 let get_sm_key_pub t = t.sm_key_pub
 
 let get_signkeys t =
@@ -31,6 +58,12 @@ let get_denoms t =
   Miou.Mutex.protect t.lock @@ fun () ->
   Hashtbl.to_seq_values t.dn_ht |> List.of_seq
 
+let find_signkey_data t pub =
+  Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.sk_ht pub
+
+let find_denom_data t h_denom =
+  Miou.Mutex.protect t.lock @@ fun () -> Hashtbl.find_opt t.dn_ht h_denom
+
 let add_signkey_master_signatures conn t l =
   Miou.Mutex.protect t.lock @@ fun () ->
   list_iter

src/secmod.mli

@@ -2,13 +2,22 @@ open Crypto
 
 type t
 
-val get_sm_key_priv : t -> eddsa_priv
+val sign_with_sm_key : t -> string -> eddsa_sig
+val sign_with_signkey : t -> pub:eddsa_pub -> string -> eddsa_sig
+val verify_with_master_key : eddsa_sig -> msg:string -> (unit, string) result
+val verify_with_sm_key : t -> eddsa_sig -> msg:string -> (unit, string) result
+
+val verify_with_signkey :
+  t -> pub:eddsa_pub -> eddsa_sig -> msg:string -> (unit, string) result
+
 val get_sm_key_pub : t -> eddsa_pub
 val get_signkeys : t -> Signkey_data.t list
 val get_denoms : t -> Denom_data.t list
-val init : (module Pg.CONN) -> t
+val find_signkey_data : t -> eddsa_pub -> Signkey_data.t option
+val find_denom_data : t -> denomination_hash -> Denom_data.t option
 
 (* - management operations - *)
+val init : (module Pg.CONN) -> t
 
 val add_signkey_master_signatures :
   (module Pg.CONN) ->

tools/offline_sig.ml

@@ -24,7 +24,8 @@ let denom_signature ~master_key
     let open Bin_sig.DenominationKeyValidity in
     let master = EddsaPrivateKey.(pub_of_priv master_key) in
     let denom_hash = DenominationHash.hash octets in
-    sign ~key:master_key
+    sign_f
+      ~f:(EddsaSignature.sign ~key:master_key)
       {
         master;
         start= stamp_start;
@@ -45,7 +46,8 @@ let signkey_signature ~master_key
       { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } =
   let master_sig =
     let open Bin_sig.ExchangeSigningKeyValidity in
-    sign ~key:master_key
+    sign_f
+      ~f:(EddsaSignature.sign ~key:master_key)
       {
         start= stamp_start;
         expire= stamp_expire;
@@ -77,7 +79,9 @@ let verify_future_signkey ~sm_signkey_pub
   let anchor_time = stamp_start in
   let duration = Timestamp.diff stamp_start stamp_expire in
   let open Bin_sig.SigningKeyAnnouncement in
-  verify ~key:sm_signkey_pub signkey_secmod_sig
+  verify_f
+    ~f:(EddsaSignature.verify ~key:sm_signkey_pub)
+    signkey_secmod_sig
     { exchange_pub; anchor_time; duration }
 
 let verify_future_denom ~sm_denom_pub
@@ -103,7 +107,9 @@ let verify_future_denom ~sm_denom_pub
   let anchor_time = stamp_start in
   let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in
   let open Bin_sig.DenominationKeyAnnouncement in
-  verify ~key:sm_denom_pub denom_secmod_sig
+  verify_f
+    ~f:(EddsaSignature.verify ~key:sm_denom_pub)
+    denom_secmod_sig
     { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
 
 let verify_future_keys_response our_master_public_key
@@ -138,13 +144,13 @@ let verify_future_keys_response our_master_public_key
 let mk_denom_revoke ~key h_denom_pub =
   let master_sig =
     let open Bin_sig.MasterDenominationKeyRevocation in
-    sign ~key { h_denom_pub }
+    sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub }
   in
   DenomRevocationSignature.{ master_sig }
 
 let mk_signkey_revoke ~key exchange_pub =
   let master_sig =
     let open Bin_sig.MasterSigningKeyRevocation in
-    sign ~key { exchange_pub }
+    sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub }
   in
   SignkeyRevocationSignature.{ master_sig }