From 77fd5653ad1a4f6816d03b707dbf8bf2c544f6cf Mon Sep 17 00:00:00 2001 From: swrup Date: Tue, 17 Feb 2026 13:01:09 +0100 Subject: [PATCH] --- src/secmod.ml | 75 +++++++++++++++++++++++++++----------------------- src/secmod.mli | 6 ++-- 2 files changed, 43 insertions(+), 38 deletions(-) diff --git a/src/secmod.ml b/src/secmod.ml index ee400d39..b61f2f5e 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -15,7 +15,7 @@ module type S = sig val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_denominations : unit -> Api.FutureDenom.t list val find_signkey : eddsa_pub -> Signkey.t option - val find_denomination : rsa_pub -> Denomination.t option + val find_denomination : denom_hash -> Denomination.t option val certify_future_signkey : eddsa_pub -> @@ -23,7 +23,7 @@ module type S = sig (unit, string) result val certify_future_denomination : - rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result + denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result val revoke_signkey : eddsa_pub -> @@ -31,7 +31,7 @@ module type S = sig (unit, string) result val revoke_denomination : - rsa_pub -> + denom_hash -> Signatures.MasterDenominationKeyRevocation.t -> (unit, string) result @@ -41,6 +41,7 @@ end module Make (Conn : Pg.CONN) = struct open Syntax open Crypto + module DenominationHash = Hash.DenominationHash type sk = Signkey.t type future_sk = Api.FutureSignKey.t @@ -52,14 +53,14 @@ module Make (Conn : Pg.CONN) = struct sm_key: eddsa_priv; sm_pubkey: eddsa_pub; sk_ht: (eddsa_pub, sk) Hashtbl.t; - dn_ht: (rsa_pub, dn) Hashtbl.t; + dn_ht: (denom_hash, dn) Hashtbl.t; sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; - dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; + dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t; future_sk_ht: (eddsa_pub, future_sk) Hashtbl.t; - future_dn_ht: (rsa_pub, future_dn) Hashtbl.t; + future_dn_ht: (denom_hash, future_dn) Hashtbl.t; future_sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; - future_dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; - dn_section_name_ht: (rsa_pub, string) Hashtbl.t; + future_dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t; + dn_section_name_ht: (denom_hash, string) Hashtbl.t; } let database_find_sk conn fname pub = @@ -72,8 +73,7 @@ module Make (Conn : Pg.CONN) = struct (Fpath.to_string fname) | Some sk_data -> Ok sk_data - let database_find_dn conn ~section_name pub = - let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in + let database_find_dn conn ~section_name h_pub = let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in match opt with | None -> @@ -139,9 +139,14 @@ module Make (Conn : Pg.CONN) = struct let* l = list_map (fun (section_name, priv) -> - let pub = RsaPrivateKey.pub_of_priv priv in - let+ dn = database_find_dn conn ~section_name pub in - ((pub, dn), (pub, priv))) + let h_pub = + priv + |> RsaPrivateKey.pub_of_priv + |> RsaPublicKey.to_octets + |> DenominationHash.hash + in + let+ dn = database_find_dn conn ~section_name h_pub in + ((h_pub, dn), (h_pub, priv))) dn_keys in let dn_ht, dn_key_ht = @@ -229,11 +234,10 @@ module Make (Conn : Pg.CONN) = struct RsaDenominationKey.{ age_mask= 0; rsa_pub= pub } in let denom_pub = DenominationKey.Rsa rsa_denomination_key in + let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in let denom_secmod_sig = let open Signatures.DenominationKeyAnnouncement in - let h_denom_pub = - Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) - in + let h_denom_pub = h_pub in let h_section_name = Hash.Cstring.H64.hash section_name in let anchor_time = stamp_start in let duration_withdraw = @@ -259,8 +263,8 @@ module Make (Conn : Pg.CONN) = struct denom_secmod_sig; } in - Hashtbl.replace t.future_dn_ht pub future_dn; - Hashtbl.replace t.future_dn_key_ht pub priv; + Hashtbl.replace t.future_dn_ht h_pub future_dn; + Hashtbl.replace t.future_dn_key_ht h_pub priv; () let make_new () = @@ -297,13 +301,14 @@ module Make (Conn : Pg.CONN) = struct let sm_pubkey = t.sm_pubkey let sign_with_sm_key s = sign_with_sm_key t s - let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg let sign_with_signkey ~pub s = match Hashtbl.find_opt t.sk_key_ht pub with | None -> Fmt.failwith "secmod failure: signkey not found." | Some priv -> EddsaSignature.sign ~key:priv s + let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg + let verify_with_master_key = EddsaSignature.verify ~key:Config.master_public_key @@ -365,14 +370,15 @@ module Make (Conn : Pg.CONN) = struct let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in Ok ()) - let certify_future_denomination pub master_sig = + let certify_future_denomination h_pub master_sig = match - ( Hashtbl.find_opt t.future_dn_ht pub, - Hashtbl.find_opt t.future_dn_key_ht pub ) + ( Hashtbl.find_opt t.future_dn_ht h_pub, + Hashtbl.find_opt t.future_dn_key_ht h_pub ) with - | None, _ | _, None -> Error "secmod failure: future signkey not found." + | None, _ | _, None -> + Error "secmod failure: future denomination not found." | Some future_dn, Some priv -> ( - match Hashtbl.find_opt t.dn_ht pub with + match Hashtbl.find_opt t.dn_ht h_pub with | Some _dn -> Error "secmod failure: this denomination already has a master signature" @@ -385,7 +391,7 @@ module Make (Conn : Pg.CONN) = struct stamp_expire_withdraw; stamp_expire_deposit; stamp_expire_legal; - denom_pub= _; + denom_pub; fee_withdraw; fee_deposit; fee_refresh; @@ -394,15 +400,14 @@ module Make (Conn : Pg.CONN) = struct } = future_dn in - (* TODO dn hash - need to compute it from denom_pub *) - let h_pub = - Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) + let rsa_pub = + match denom_pub with + | Rsa Api.RsaDenominationKey.{ age_mask= _; rsa_pub } -> rsa_pub in let dn = Denomination. { - pub; + pub= rsa_pub; value; stamp_start; stamp_expire_withdraw; @@ -418,11 +423,11 @@ module Make (Conn : Pg.CONN) = struct revoked_sig= None; } in - Hashtbl.replace t.dn_ht pub dn; - Hashtbl.replace t.dn_key_ht pub priv; - Hashtbl.replace t.dn_section_name_ht pub section_name; - Hashtbl.remove t.future_dn_ht pub; - Hashtbl.remove t.future_dn_key_ht pub; + Hashtbl.replace t.dn_ht h_pub dn; + Hashtbl.replace t.dn_key_ht h_pub priv; + Hashtbl.replace t.dn_section_name_ht h_pub section_name; + Hashtbl.remove t.future_dn_ht h_pub; + Hashtbl.remove t.future_dn_key_ht h_pub; let* () = Pg.insert_denom (module Conn) dn |> unwrap_err_caqti in Ok ()) diff --git a/src/secmod.mli b/src/secmod.mli index 6e1a90cb..9c266a2b 100644 --- a/src/secmod.mli +++ b/src/secmod.mli @@ -15,7 +15,7 @@ module type S = sig val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_denominations : unit -> Api.FutureDenom.t list val find_signkey : eddsa_pub -> Signkey.t option - val find_denomination : rsa_pub -> Denomination.t option + val find_denomination : denom_hash -> Denomination.t option val certify_future_signkey : eddsa_pub -> @@ -23,7 +23,7 @@ module type S = sig (unit, string) result val certify_future_denomination : - rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result + denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result val revoke_signkey : eddsa_pub -> @@ -31,7 +31,7 @@ module type S = sig (unit, string) result val revoke_denomination : - rsa_pub -> + denom_hash -> Signatures.MasterDenominationKeyRevocation.t -> (unit, string) result