src/denomination.ml

@@ -110,3 +110,11 @@ let make_denom_group_sorted denominations =
     |> List.sort cmp_group
   in
   l
+
+let hash_over_master_sigs denominations =
+  denominations
+  |> List.map (fun (Api.DenomGroup.Rsa g) -> g.Api.RsaDenomGroup.denoms)
+  |> List.concat_map (List.map (fun dn -> dn.Api.RsaDenom.master_sig))
+  |> List.map Signatures.DenominationKeyValidity.to_octets
+  |> String.concat ""
+  |> Hash.H64.hash

src/http_info.ml

@@ -104,16 +104,13 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
 
   (* ! depends on denominations order *)
   let exchange_sig =
-    let hc =
-      denominations
-      |> List.map (fun (DenomGroup.Rsa g) -> g.RsaDenomGroup.denoms)
-      |> List.concat_map (List.map (fun dn -> dn.RsaDenom.master_sig))
-      |> List.map Signatures.DenominationKeyValidity.to_octets
-      |> String.concat ""
-      |> Hash.H64.hash
-    in
     let open Signatures.ExchangeKeySet in
-    signf (Keys.sign exchange_pub) R.{ list_issue_date; hc }
+    signf (Keys.sign exchange_pub)
+      R.
+        {
+          list_issue_date;
+          hc= Denomination.hash_over_master_sigs denominations;
+        }
   in
 
   let recoup = (* /recoup *) [] in

test/validate_response.ml

@@ -64,7 +64,15 @@ let keys content =
         if Signkey.is_valid_at ~timestamp:now sk then Ok ()
         else Fmt.error "exchange_pub is not valid at the current time"
   in
-  (* validate exchange_sig *)
+  let* () =
+    let open Signatures.ExchangeKeySet in
+    verify v.exchange_pub v.exchange_sig
+      R.
+        {
+          list_issue_date= v.list_issue_date;
+          hc= Denomination.hash_over_master_sigs v.denominations;
+        }
+  in
 
   (* validate denominations *)
   (* validate global-fees *)