From 69d02e5978a9fd7617913e27abcd10788626bae9 Mon Sep 17 00:00:00 2001 From: swrup Date: Sat, 24 Jan 2026 06:12:52 +0100 Subject: [PATCH] --- data/secmod/dn_0 | Bin 0 -> 1176 bytes data/secmod/dn_1 | Bin 0 -> 1176 bytes data/secmod/sk_0 | 1 + data/secmod/sm_key | 1 + src/secmod.ml | 59 +++++++++++++++++++++++++-------------------- 5 files changed, 35 insertions(+), 26 deletions(-) create mode 100644 data/secmod/dn_0 create mode 100644 data/secmod/dn_1 create mode 100644 data/secmod/sk_0 create mode 100644 data/secmod/sm_key diff --git a/data/secmod/dn_0 b/data/secmod/dn_0 new file mode 100644 index 0000000000000000000000000000000000000000..2ad25f3b4ddbdb4590f807f8682db89a895bf2d2 GIT binary patch literal 1176 zcmZSJU}RuqU}%6t1_lNOMg~UqCpG&-CW}i;*B^Msu(^tnWt!`}yWjXvSWXr6_1u&D z@Q8$1dH#iiGZmVY=QXS{YM8W>t$x-!?Ml;a3X_x?StX-eMN;>D{;j`%w|2GK()oMM z4d1pn&N|A?>biSM?KbAUx6|Esg*4A%R+}I2Cg$Xkl9>CgQJVAQzxS?Qoc-|La_{8A z>K6~A-QyRPF!lG}3u=>% zwcb~J|72jLU6$P7yyy1ethYA%o~nquCU57t)_6@U^rsfX-6xOkue|%DhRNjfeGkr8 zsnYumi}N=$1kQadf8lIn%ESBVZx^&@yq_I(ebXfa%Q&O0IzC@7#OA6@R#~XDr}SM# zg-c~E7SN|F_+-(_tCJ7#LsJL<|Dsz+U>2igQ z>+;;ncHU22mUK_N=GOMFuXnV65zRmTIOLw^hugUvc6lo5yB?dc#mDeUrcArWlK3;} z^%8T-W2>vBZT_s(KK!k8YK`*i?o{{uX`X)+1R8U@=g3Nn&9}b$f9oR)m$SDHY^(ga zQY>ReL+~}nZ@w-j=_AY5P-S@k_qOMcyJZri?Qv0HNe&iS7uDFSPLnfNHZ zzpCghe0$cCdslgxw*8b=zmyt#EhO1z>2BAlb3CqmsCjHz`X%rAs_Ay;Dy)|CY%sG} zs;pck{xIl%3!Cek<{28@U5sMQ+f081R8)!Wd62egS~>TG#dAEQ?rY|IS*@;7-W8$n zC-2FD_TRxeuU8txD{}sMeSW$}%!GO`#mh_PWY0R%;!(PoUE=nNimPHPWTs#K;nAr0 zn`Q3(dFM;`y0`pW;IV}{aKW)a%Y(U7x6D>AH9uB%_IYxUfsl2QgQBEW!P!gElNpZa z<$u|{sC(MV-+Mlr&0##mdB8RN=wYtON}lXab3Cq88pN5Zyt(%-L3k&7<@uLts^9lc zHk_yQi6d%qRo~KI;j`WA-9nbsFs9G`%+q?*=&XpALu&c1kjHE0O`YX*^q7jpOTDli z4O$L2C*S;j$jMCH&C#Or%L=)-7qsH)O%h{zW-ed1pHurL=jW+g*Bd`_FcpZ{5?d3w zZ=3!3g?{_Co}O^;y#-gT!y%QK=bN1;Fq!o))JmDx@bD(%#=UO^XKj$1#kD+&b=p=@ zN%yeaQ_hOkj0X>VZwsGjC*xiI)A>%!;qt8vd=M0Go2XNr1CW5)-CpST4irUKH-t te&*1Yb2BEMWKKA8|J|dkm49t*zbq_X%=oT<0>jZ|`Ytv{Zb%8N001FFK%W2r literal 0 HcmV?d00001 diff --git a/data/secmod/dn_1 b/data/secmod/dn_1 new file mode 100644 index 0000000000000000000000000000000000000000..c11d3de4313079e9f0f9726ee82b469f6f5ff2d6 GIT binary patch literal 1176 zcmZSJU}RuqU}%6t1_lNOMg~S6e;=0lf||(;VwUqKo~%7G?fP!@^z9G-@p^ACIKwB| z(Y5Or`@D?Zr#+vFd)lhcH1qJ+JS-HE#2R{Oi%9yK7e-%1RleR>+t{Vw%>Q_)!^z!h z&!)Yd^OQ*{tpA==;cUOV^Y%3q7QTEVvflKErcRflNJU@ZzsdfN3)bIJzq;Fde?yN? zad5}|Snso~e=k08-nXF7%WCq={a@$TWgjwjUN})K%JzYvX-x5Y-O$zxZri%ep7=U6 z8|)BJb$p*;xMS;VFOU5H=H8)m^e08AS;i_JKB*<#JKOC4@67x?erGH6R^5Gmdf9(B z^*PS3HcsYbx_T-@=FUqirIT{kX7;|*pSirFamU6TY;LPH8`-pu1RF%XXHxZ6T56iH z!nmVr(bsaeCyq~qIi^?eoV@Yr$pe;8ulLzVO^$Hq;wf@@`Q7;M1H+9LzfYQ2D2RA< zaJXAnge*U8f41z~y>h!Fj~Wyucyuy(mmQmA^O>n@)zm|~e+8Xh=dNGeC>C^O&(Yg0 z9FKqX&6j@txJ}lju1dL{M`gC&cKf}nRP_beBC=-Ietr3Qclc6AQ3fIV$62?|->dks z`I`v)m0M4wm;_&mFEJGs?mN9|j^V6s_}P|k<*)uO;?jIO^_`_`%q5fC)s|9lo zE%U(V@{vM=c3yVF}rOH9&`w7 zn>**&W22uPZ&MPKIm^#J5_Zf@K6bw^%< ze#N!;w)iLBr$Y7SFaO0Pe}A*3gL#Y6*$GWA*SekglyJz==D?j7UUK2PzusUsP;r{S zmvyDsdxOl~5|^H2q)sxl_`L1>(Jz0J6?q@$J^8d=y<25@Q+?Wj_2maF4e$9HhVLkw zZo9#->SAfjj;BHW%(Z?CWNHq6D2~>;E4v}kM*99OQ~z5h9*HlUvhib+^KqW=O6iYG z-n(~f2%X{Ao5y^q|Lup$eHE9Z>XTzxQ#xh|O8w!=_bi^@+H>PrfxoL??NNr-vkWKx ztOzX+U-&FUwZo6;n^?z&wy*>?!vn9Kx!%6H!ph0D{PLOgPPPUed{Y+Jm*|-}i*ZFf z-SKAKzQ~hXw5zt?eVA~|>*gkjPnYj(^W0@zv};9p?*{Kk-sg{cmp!@VRuCH~bcRhW z&CmO7VO^i~sjnFa{w4?Iii$sMSjzb2gihGyr-kp!u4m-!R`Si+b+_1PIk(28nTvPp pCCvX?*x4OeZqNQ{M(GJQ&DC=XSPGJh#Sb-$7hKfiU%KN67XSf3Jgfi! literal 0 HcmV?d00001 diff --git a/data/secmod/sk_0 b/data/secmod/sk_0 new file mode 100644 index 00000000..8b1e3b5e --- /dev/null +++ b/data/secmod/sk_0 @@ -0,0 +1 @@ +!hrmgŪ1t%15ZDT| \ No newline at end of file diff --git a/data/secmod/sm_key b/data/secmod/sm_key new file mode 100644 index 00000000..1e7e9db2 --- /dev/null +++ b/data/secmod/sm_key @@ -0,0 +1 @@ +=A"̰*/j*j cIo \ No newline at end of file diff --git a/src/secmod.ml b/src/secmod.ml index d56a1c98..8c498155 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -70,7 +70,7 @@ module Make (Conn : Pg.CONN) = struct dn_section_name_ht: (denomination_hash, string) Hashtbl.t; } - let dir = Fpath.(v "data" / "secmod ") + let dir = Fpath.(v "data" / "secmod") let db_lookup_signkey_data conn fname priv = let pub = EddsaPrivateKey.pub_of_priv priv in @@ -110,7 +110,7 @@ module Make (Conn : Pg.CONN) = struct in let* sm_key_priv = Data_file.read_eddsa Fpath.(dir / "sm_key") in let* signkeys = - let l = List.init 1 (fun i -> Fpath.(dir / string_of_int i)) in + let l = List.init 1 (fun i -> Fpath.(dir / Fmt.str "sk_%d" i)) in let* l = list_map (fun fname -> load_signkey conn fname) l in match opt_list l with Error () -> error_invalid_state | Ok opt -> Ok opt in @@ -249,18 +249,44 @@ module Make (Conn : Pg.CONN) = struct in { lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht } + let store t = + let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in + let* () = + Hashtbl.to_seq_values t.sk_ht + |> List.of_seq + |> List.mapi (fun i (key : signkey) -> + let fname = Fpath.(dir / Fmt.str "sk_%d" i) in + (fname, key.priv)) + |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key) + in + let* () = + Hashtbl.to_seq_values t.dn_ht + |> List.of_seq + |> List.map (fun (key : denom) -> + let section_name = + Hashtbl.find t.dn_section_name_ht key.dn_data.h_pub + in + let fname = Fpath.(dir / section_name) in + (fname, key.priv)) + |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key) + in + Ok () + let t = match load (module Conn) with | Ok None -> let t = make_new () in + let () = + match store t with + | Error (`Msg e) -> Fmt.failwith "secmod storage failure: %s." e + | Ok () -> () + in Logs.info (fun m -> m "secmod initialized with fresh keys"); t - | Ok (Some v) -> + | Ok (Some t) -> Logs.info (fun m -> m "secmod initialized from storage"); - v - | Error _ -> - (* TODO error: pretty print *) - Fmt.failwith "secmod init failure." + t + | Error _ -> Fmt.failwith "secmod init failure." (* note: don't expose a signing function if we want a real "security module" one day *) let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s @@ -369,23 +395,4 @@ module Make (Conn : Pg.CONN) = struct let denom = { denom with dn_data } in Hashtbl.replace t.dn_ht h_denom_pub denom; Ok () - - (* TODO *) - let _store t = - let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in - let* () = - get_signkeys () - |> List.mapi (fun i (key : signkey) -> - let fname = Fpath.(dir / string_of_int i) in - (fname, key.priv)) - |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key) - in - let* () = - get_denoms () - |> List.mapi (fun i (key : denom) -> - let fname = Fpath.(dir / string_of_int i) in - (fname, key.priv)) - |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key) - in - Ok () end