secmod_rsa: use denom_hash

src/secmod_rsa.ml

@@ -1,6 +1,4 @@
-(* TODO
-   refacto common parts with secmod_eddsa
-   use DenominationHash.t instead of rsa_pub? *)
+(* TODO refacto common parts with secmod_eddsa *)
 let src = Logs.Src.create "mte.secmod_rsa"
 
 module Log = (val Logs.src_log src : Logs.LOG)
@@ -9,6 +7,7 @@ module Log = (val Logs.src_log src : Logs.LOG)
 open Syntax
 open Crypto
 open Time
+module DenominationHash = Hash.DenominationHash
 
 module Cfg = struct
   open Config
@@ -45,6 +44,7 @@ type key = {
   section_name: string;
   priv: RsaPrivateKey.t;
   pub: RsaPublicKey.t;
+  h_pub: DenominationHash.t;
   t1: Absolute.t;
   t2: Absolute.t;
 }
@@ -52,7 +52,7 @@ type key = {
 type t = {
   sm_key_priv: EddsaPrivateKey.t;
   sm_pub: EddsaPublicKey.t;
-  ht: (RsaPublicKey.t, key) Hashtbl.t;
+  ht: (DenominationHash.t, key) Hashtbl.t;
 }
 
 let parse_filename =
@@ -119,10 +119,11 @@ let get_key_dir_contents dir_fpath =
 let gen_key ~section_name t1 t2 =
   let bits = Cfg.rsa_keysize ~section_name in
   let priv, pub = RsaPrivateKey.generate ~bits () in
+  let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
   Log.debug (fun m ->
       m "generated key (%a):@,`%s`" pp_filename (t1, t2)
-        (RsaPublicKey.to_b32 pub));
-  { section_name; priv; pub; t1; t2 }
+        (DenominationHash.to_octets h_pub |> B32.encode));
+  { section_name; priv; pub; h_pub; t1; t2 }
 
 let sort_keys l = List.sort (fun a b -> Absolute.compare a.t2 b.t2) l
 
@@ -172,7 +173,8 @@ let load_key ~section_name fpath =
   | Some (t1, t2) ->
       let+ priv = read_rsa fpath in
       let pub = RsaPrivateKey.pub_of_priv priv in
-      { section_name; priv; pub; t1; t2 }
+      let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
+      { section_name; priv; pub; h_pub; t1; t2 }
 
 let load_section section_name =
   let section_fpath = Fpath.(v Cfg.key_dir / section_name) in
@@ -194,7 +196,7 @@ let load () =
       let* sm_key_priv = read_eddsa sm_key_fpath in
       let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
       let ht = Hashtbl.create 0xff in
-      let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
+      let () = List.iter (fun k -> Hashtbl.replace ht k.h_pub k) keys in
       Ok (Some { sm_key_priv; sm_pub; ht })
 
 let init () =
@@ -222,7 +224,7 @@ let init () =
       Cfg.sections
   in
   let new_keys = List.concat new_keys_l in
-  let () = List.iter (fun k -> Hashtbl.replace t.ht k.pub k) new_keys in
+  let () = List.iter (fun k -> Hashtbl.replace t.ht k.h_pub k) new_keys in
   let+ () = list_iter write_key new_keys in
   t
 
@@ -238,42 +240,43 @@ module Make () = struct
     | Error e -> Fmt.failwith "secmod_rsa initialization failure: %s." e
     | Ok t -> t
 
-  let find pub =
-    Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
+  let find h_pub =
+    Hashtbl.find_opt t.ht h_pub |> Option.to_result ~none:"key not found"
 
-  let delete pub =
-    let* k = find pub in
-    Hashtbl.remove t.ht k.pub;
+  let delete h_pub =
+    let* k = find h_pub in
+    Hashtbl.remove t.ht h_pub;
     delete_file (key_fpath k)
 
   let _delete_outdated ~now =
-    Hashtbl.to_seq_values t.ht
+    Hashtbl.to_seq t.ht
     |> List.of_seq
-    |> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
-    |> List.map (fun k -> k.pub)
+    |> List.filter (fun (_h_pub, k) -> Absolute.compare now k.t2 >= 0)
+    |> List.map (fun (h_pub, _k) -> h_pub)
     |> list_iter delete
 
   let add section_name t1 t2 =
     let k = gen_key ~section_name t1 t2 in
-    Hashtbl.replace t.ht k.pub k;
+    Hashtbl.replace t.ht k.h_pub k;
     ()
 
   let sm_pub = t.sm_pub
   let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
 
-  let sign pub s =
-    let+ k = find pub in
+  let sign h_pub s =
+    let+ k = find h_pub in
     let data = RsaSignature.sign ~key:k.priv s in
     data
 
-  let revoke pub =
-    let* k = find pub in
-    let* () = delete pub in
+  let revoke h_pub =
+    let* k = find h_pub in
+    let* () = delete h_pub in
     add k.section_name k.t1 k.t2;
     Ok ()
 
   let conv =
-   fun { section_name; priv= _; pub; t1; t2= _ } -> (pub, (section_name, t1))
+   fun { section_name; priv= _; pub; h_pub; t1; t2= _ } ->
+    (h_pub, (section_name, pub, t1))
 
   let keys () = Hashtbl.to_seq_values t.ht |> List.of_seq |> List.map conv
   let find_key pub = Hashtbl.find_opt t.ht pub |> Option.map conv