+ rename

src/http_info.ml

@@ -173,7 +173,7 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
       |> Hash.H64.hash
     in
     let open Signatures.ExchangeKeySet in
-    signf (Keys.sign ~pub:exchange_pub) R.{ list_issue_date; hc }
+    signf (Keys.sign exchange_pub) R.{ list_issue_date; hc }
   in
 
   let recoup = (* TODO /recoup *) [] in

src/keys.ml

@@ -1,28 +1,35 @@
 (* TODO better error type *)
 type 'a result = ('a, string) Result.t
 
-module type S = Mod_intf.S
+module type S = Mod_intf.KEYS
 
 module Make (Conn : Pg.CONN) = struct
+  let conn = (module Conn : Pg.CONN)
+
   open Syntax
   open Crypto
 
   let master_pub = Config.Exchange.master_public_key
-  let secmod_rsa_pub = Secmod_rsa.sm_key_pub
+  let secmod_rsa_pub = Secmod_rsa.sm_pub
-  let secmod_eddsa_pub = Secmod_eddsa.sm_key_pub
+  let secmod_eddsa_pub = Secmod_eddsa.sm_pub
 
-  let sign ~pub s =
+  (* TODO error
-    Secmod_eddsa.sign ~pub s |> function
+     should be a "key not found", either:
+       - we tried to sign with a key that is not ours
+       - key was revoked
+       - bad keyring state
+     *)
+  let sign pub s =
+    match Secmod_eddsa.sign ~pub s with
     | Error e -> Fmt.failwith "sign failure: %s." e
     | Ok v -> v
 
-  let sign_denom ~pub s =
+  let sign_denom pub s =
-    Secmod_rsa.sign ~pub s |> function
+    match Secmod_rsa.sign ~pub s with
     | Error e -> Fmt.failwith "sign_denom failure: %s." e
     | Ok v -> v
 
   (* - *)
-  let conn = (module Conn : Pg.CONN)
   let find_signkey pub = Pg.find_signkey conn pub |> unwrap_err_caqti
   let find_denomination h_pub = Pg.find_denom conn h_pub |> unwrap_err_caqti
 
@@ -42,8 +49,7 @@ module Make (Conn : Pg.CONN) = struct
       let exchange_pub = pub in
       let anchor_time = stamp_start in
       let duration = Timestamp.diff stamp_start stamp_expire in
-      signf Secmod_eddsa.sign_with_sm_key
+      signf Secmod_eddsa.sign_secmod { exchange_pub; anchor_time; duration }
-        { exchange_pub; anchor_time; duration }
     in
     Api.FutureSignKey.
       { key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
@@ -90,7 +96,7 @@ module Make (Conn : Pg.CONN) = struct
       let duration_withdraw =
         Timestamp.diff stamp_start stamp_expire_withdraw
       in
-      signf Secmod_rsa.sign_with_sm_key
+      signf Secmod_rsa.sign_secmod
         { h_denom_pub; h_section_name; anchor_time; duration_withdraw }
     in
     FutureDenom.
@@ -265,10 +271,8 @@ module Make (Conn : Pg.CONN) = struct
 
   let revoke_signkey pub revoked_sig =
     let* opt = find_signkey pub in
-    match opt with
+    let* _sk = Option.to_result ~none:"signkey not found" opt in
-    | None -> Error "signkey not found"
+    let* () = Secmod_eddsa.revoke pub in
-    | Some _sk ->
-        let* () = Secmod_eddsa.revoke_key pub in
     let+ () =
       Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_err_caqti
     in
@@ -276,11 +280,9 @@ module Make (Conn : Pg.CONN) = struct
 
   let revoke_denomination h_pub revoked_sig =
     let* opt = find_denomination h_pub in
-    match opt with
+    let* dn = Option.to_result ~none:"denomination not found" opt in
-    | None -> Error "denomination not found"
+    let pub = dn.pub in
-    | Some sk ->
+    let* () = Secmod_rsa.revoke pub in
-        let pub = sk.pub in
-        let* () = Secmod_rsa.revoke_key pub in
     let+ () =
       Pg.insert_denomination_revocation conn h_pub revoked_sig
       |> unwrap_err_caqti

src/keys.mli

@@ -1,3 +1,3 @@
-module type S = Mod_intf.S
+module type S = Mod_intf.KEYS
 
 module Make (_ : Pg.CONN) : S

src/mod_intf.mli

@@ -1,13 +1,13 @@
 type 'a result = ('a, string) Result.t
 
-module type S = sig
+module type KEYS = sig
   open Crypto
 
   val master_pub : eddsa_pub
   val secmod_rsa_pub : eddsa_pub
   val secmod_eddsa_pub : eddsa_pub
-  val sign : pub:eddsa_pub -> string -> eddsa_sig
+  val sign : eddsa_pub -> string -> eddsa_sig
-  val sign_denom : pub:rsa_pub -> string -> string
+  val sign_denom : rsa_pub -> string -> string
   val find_signkey : eddsa_pub -> Signkey.t option result
   val find_denomination : denom_hash -> Denomination.t option result
   val signkeys : unit -> Signkey.t list result

src/secmod_eddsa.ml

@@ -12,7 +12,7 @@ type key = {
 
 type t = {
   sm_key_priv: EddsaPrivateKey.t;
-  sm_key_pub: EddsaPublicKey.t;
+  sm_pub: EddsaPublicKey.t;
   ht: (EddsaPublicKey.t, key) Hashtbl.t;
 }
 
@@ -137,10 +137,10 @@ let load () =
   | [] -> Ok None
   | _l ->
       let* sm_key_priv = read_key sm_key_fpath in
-      let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
+      let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
       let ht = Hashtbl.create 0xff in
       let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
-      Ok (Some { sm_key_priv; sm_key_pub; ht })
+      Ok (Some { sm_key_priv; sm_pub; ht })
 
 let init () =
   let* opt = load () in
@@ -148,10 +148,10 @@ let init () =
     match opt with
     | Some t -> Ok t
     | None ->
-        let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in
+        let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in
         let* () = write_eddsa sm_key_fpath sm_key_priv in
         let ht = Hashtbl.create 0xff in
-        Ok { sm_key_priv; sm_key_pub; ht }
+        Ok { sm_key_priv; sm_pub; ht }
   in
   let now = Absolute.of_ptime (Ptime_clock.now ()) in
   let keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in
@@ -167,25 +167,17 @@ let t =
   | Error e -> Fmt.failwith "secmod_eddsa initialization failure: %s." e
   | Ok t -> t
 
-let sm_key_pub = t.sm_key_pub
+let find pub =
-
-let keys () =
-  Hashtbl.to_seq_values t.ht
-  |> List.of_seq
-  |> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2))
-
-let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s
-
-let find_key pub =
   Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
 
-let sign ~pub s =
+let add t1 t2 =
-  let+ k = find_key pub in
+  let priv, pub = EddsaPrivateKey.generate () in
-  let data = EddsaSignature.sign ~key:k.priv s in
+  let k = { priv; pub; t1; t2 } in
-  data
+  Hashtbl.replace t.ht k.pub k;
+  ()
 
-let delete_key pub =
+let delete pub =
-  let* k = find_key pub in
+  let* k = find pub in
   Hashtbl.remove t.ht k.pub; delete_key_file k
 
 let delete_outdated ~now =
@@ -193,23 +185,33 @@ let delete_outdated ~now =
   |> List.of_seq
   |> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
   |> List.map (fun k -> k.pub)
-  |> list_iter delete_key
+  |> list_iter delete
 
-let add_key t1 t2 =
+(* ---- *)
-  let priv, pub = EddsaPrivateKey.generate () in
+
-  let k = { priv; pub; t1; t2 } in
+let sm_pub = t.sm_pub
-  Hashtbl.replace t.ht k.pub k;
+
-  ()
+let keys () =
+  Hashtbl.to_seq_values t.ht
+  |> List.of_seq
+  |> List.map (fun { priv= _; pub; t1; t2 } -> (pub, t1, t2))
+
+let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
+
+let sign ~pub s =
+  let+ k = find pub in
+  let data = EddsaSignature.sign ~key:k.priv s in
+  data
 
 (* delete and replace *)
-let revoke_key pub =
+let revoke pub =
-  let* k = find_key pub in
+  let* k = find pub in
-  let* () = delete_key pub in
+  let* () = delete pub in
-  add_key k.t1 k.t2; Ok ()
+  add k.t1 k.t2; Ok ()
 
 (* TODO
   - more checks
-  - sign: check time
+  - sign: check timestamps before signing
   - schedule tasks
   - !lock
 

src/secmod_rsa.ml

@@ -14,7 +14,7 @@ type key = {
 
 type t = {
   sm_key_priv: EddsaPrivateKey.t;
-  sm_key_pub: EddsaPublicKey.t;
+  sm_pub: EddsaPublicKey.t;
   ht: (RsaPublicKey.t, key) Hashtbl.t;
 }
 
@@ -153,10 +153,10 @@ let load () =
   | [] -> Ok None
   | _l ->
       let* sm_key_priv = read_eddsa sm_key_fpath in
-      let sm_key_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
+      let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
       let ht = Hashtbl.create 0xff in
       let () = List.iter (fun k -> Hashtbl.replace ht k.pub k) keys in
-      Ok (Some { sm_key_priv; sm_key_pub; ht })
+      Ok (Some { sm_key_priv; sm_pub; ht })
 
 let init () =
   let* opt = load () in
@@ -164,10 +164,10 @@ let init () =
     match opt with
     | Some t -> Ok t
     | None ->
-        let sm_key_priv, sm_key_pub = EddsaPrivateKey.generate () in
+        let sm_key_priv, sm_pub = EddsaPrivateKey.generate () in
         let* () = write_eddsa sm_key_fpath sm_key_priv in
         let ht = Hashtbl.create 0xff in
-        Ok { sm_key_priv; sm_key_pub; ht }
+        Ok { sm_key_priv; sm_pub; ht }
   in
   let now = Absolute.of_ptime (Ptime_clock.now ()) in
   let all_keys = List.of_seq @@ Hashtbl.to_seq_values t.ht in
@@ -193,26 +193,11 @@ let t =
   | Error e -> Fmt.failwith "secmod_rsa initialization failure: %s." e
   | Ok t -> t
 
-let sm_key_pub = t.sm_key_pub
+let find pub =
-
-let keys () =
-  Hashtbl.to_seq_values t.ht
-  |> List.of_seq
-  |> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
-      (section_name, pub, t1, t2))
-
-let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s
-
-let find_key pub =
   Hashtbl.find_opt t.ht pub |> Option.to_result ~none:"key not found"
 
-let sign ~pub s =
+let delete pub =
-  let+ k = find_key pub in
+  let* k = find pub in
-  let data = RsaSignature.sign ~key:k.priv s in
-  data
-
-let delete_key pub =
-  let* k = find_key pub in
   Hashtbl.remove t.ht k.pub; delete_key_file k
 
 let delete_outdated ~now =
@@ -220,17 +205,33 @@ let delete_outdated ~now =
   |> List.of_seq
   |> List.filter (fun k -> Absolute.compare now k.t2 >= 0)
   |> List.map (fun k -> k.pub)
-  |> list_iter delete_key
+  |> list_iter delete
 
-let add_key section_name t1 t2 =
+let add section_name t1 t2 =
   let priv, pub = RsaPrivateKey.generate ~bits:Cfg.rsa_keysize () in
   let k = { section_name; priv; pub; t1; t2 } in
   Hashtbl.replace t.ht k.pub k;
   ()
 
-(* delete and replace *)
+(* ---- *)
-let revoke_key pub =
+
-  let* k = find_key pub in
+let sm_pub = t.sm_pub
-  let* () = delete_key pub in
+
-  add_key k.section_name k.t1 k.t2;
+let keys () =
+  Hashtbl.to_seq_values t.ht
+  |> List.of_seq
+  |> List.map (fun { section_name; priv= _; pub; t1; t2 } ->
+      (section_name, pub, t1, t2))
+
+let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s
+
+let sign ~pub s =
+  let+ k = find pub in
+  let data = RsaSignature.sign ~key:k.priv s in
+  data
+
+let revoke pub =
+  let* k = find pub in
+  let* () = delete pub in
+  add k.section_name k.t1 k.t2;
   Ok ()