src/crypto.ml

@@ -236,12 +236,47 @@ module Kdf = struct
   module XTR = Hkdf.Make (Digestif.SHA512)
   module PRF = Hkdf.Make (Digestif.SHA256)
 
-  let kdf ~salt ~ikm ~info ~len =
+  let kdf ~xts ~ikm ~ctx ~len =
-    let prk = XTR.extract ~salt ikm in
+    let prk = XTR.extract ~salt:xts ikm in
-    let okm = PRF.expand ~prk ~info len in
+    let okm = PRF.expand ~prk ~info:ctx len in
     okm
 end
 
+let kdf_mod_n ~n ~xts ~ikm ~ctx =
+  let nbits = Z.numbits n in
+  let rec go ctr =
+    let len = ((nbits - 1) / 8) + 1 in
+    let ctr_be =
+      let b = Bytes.create 2 in
+      Bytes.set_uint16_be b 0 ctr;
+      Bytes.unsafe_to_string b
+    in
+    let ctx = String.cat ctx ctr_be in
+    let okm = Kdf.kdf ~xts ~ikm ~ctx ~len in
+    let r = Z.of_bits okm in
+    if Z.gt r n then go (succ ctr) else r
+  in
+  go 0
+
+let rsa_full_domain_hash pub msg =
+  let xts = RsaPublicKey.to_octets pub in
+  let ctx = "RSA-FDA FTpsW!" in
+  let r = kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
+  r
+
+let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
+  let xts = "Blinding KDF extractor HMAC key" in
+  let ctx = "Blinding KDF" in
+  let r = kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
+  r
+
+(*
+  let rsa_blind pub ~bks ~msg =
+    let data = rsa_full_domain_hash pub msg in
+    let bkey = rsa_blinding_key_derive pub bks in
+    (* .. *)
+  *)
+
 module RsaPrivateKey = struct
   open Mirage_crypto_pk.Rsa
 

test/crypto.ml

@@ -86,11 +86,11 @@ let () =
     "GTMR4QT05Z9WF5HKVG0WK9RPXGHSMHJNW377G9GJXCA8B0FEKPF4D27RJMSJZYWSQNTBJ5EYVV7ZW18B48Z0JVJJ80RHB706Y96Q358"
   in
 
-  let salt = salt |> decode in
+  let xts = salt |> decode in
   let ikm = ikm |> decode in
-  let info = ctx |> decode in
+  let ctx = ctx |> decode in
-  let km = Crypto.Kdf.kdf ~salt ~ikm ~info ~len:out_len in
+  let okm = Crypto.Kdf.kdf ~xts ~ikm ~ctx ~len:out_len in
-  let km = km |> encode in
+  let okm = okm |> encode in
-  assert (km = out);
+  assert (okm = out);
 
   ()