fdh-rsa: use Eqaf

src/crypto.ml

@@ -248,18 +248,9 @@ module RsaPrivateKey = struct
     Jsont.of_of_string ~kind:"RsaPrivateKey" of_b32 ~enc:to_b32
 end
 
-module RsaSignature : sig
-  type t
-
-  val jsont : t Jsont.t
-  val sign : key:RsaPrivateKey.t -> string -> t
-end = struct
+module RsaSignature = struct
   type t = string
 
-  (* TODO crypto
-     this is a placeholder signature algorithm *)
-  let sign ~key s = Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~key s
-
   let jsont =
     let of_b32 s = B32.decode s in
     let to_b32 t = B32.encode t in
@@ -274,104 +265,3 @@ type rsa_priv = RsaPrivateKey.t
 type rsa_pub = RsaPublicKey.t
 type rsa_sig = RsaSignature.t
 type denom_hash = Hash.DenominationHash.t
-
-(* WIP *)
-module FDH_RSA = struct
-  open Mirage_crypto_pk
-
-  module Kdf = struct
-    module XTR = Hkdf.Make (Digestif.SHA512)
-    module PRF = Hkdf.Make (Digestif.SHA256)
-
-    let kdf =
-     fun ~xts ~ikm ~ctx ~len ->
-      let prk = XTR.extract ~salt:xts ikm in
-      let okm = PRF.expand ~prk ~info:ctx len in
-      okm
-
-    let kdf_mod_n ~n ~xts ~ikm ~ctx =
-      let nbits = Z.numbits n in
-      let len = ((nbits - 1) / 8) + 1 in
-      assert (8 * len = nbits);
-      let rec go ctr =
-        (* cat ctx ctr_be *)
-        let ctx =
-          let ctx_len = String.length ctx in
-          let b = Bytes.create (ctx_len + 2) in
-          Bytes.blit_string ctx 0 b 0 ctx_len;
-          Bytes.set_uint16_be b ctx_len ctr;
-          Bytes.unsafe_to_string b
-        in
-        let okm = kdf ~xts ~ikm ~ctx ~len in
-        assert (String.length okm = len);
-        let r = Z_extra.of_octets_be okm in
-        if Z.gt r n then go (succ ctr) else r
-      in
-      go 0
-  end
-
-  let gcd_validate r n =
-    match Z.equal (Z.gcd r n) Z.one with
-    | true -> ()
-    | false -> Fmt.failwith "RSA key is malicious"
-
-  let rsa_full_domain_hash pub msg =
-    let xts = RsaPublicKey.to_octets pub in
-    let ctx = "RSA-FDA FTpsW!" in
-    let r = Kdf.kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
-    gcd_validate r pub.n; r
-
-  let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
-    let xts = "Blinding KDF extractor HMAC key" in
-    let ctx = "Blinding KDF" in
-    let r = Kdf.kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
-    gcd_validate r pub.n; r
-
-  let rsa_blind pub ~bks ~msg =
-    let data = rsa_full_domain_hash pub msg in
-    let bkey = rsa_blinding_key_derive pub bks in
-    (* can we just use [powm] here instead? *)
-    let r_e = Z.powm_sec bkey pub.e pub.n in
-    let data_r_e = Z.rem (Z.mul data r_e) pub.n in
-    Z_extra.to_octets_be data_r_e
-
-  (* -- WIP crypto -- *)
-
-  (* TODO crypto
-     not sure about signature scheme used by taler
-     libgnunetutil crypto_rsa.c use "(flags raw)" => no padding *)
-  (* decrypt <=> sign *)
-  let rsa_sign_z priv r =
-    let data = Z_extra.to_octets_be r in
-    Rsa.decrypt ~crt_hardening:true ~key:priv data
-
-  (* TODO crypto
-     look into mirage-crypto for this
-     use Eqaf for constant time string compare *)
-  let rsa_verify_z pub r sig_ =
-    let data = Z_extra.to_octets_be r in
-    let sig_' = Rsa.encrypt ~key:pub data in
-    match String.equal sig_ sig_' with
-    | false -> Fmt.error "RSA signature verification failed"
-    | true -> Ok ()
-
-  let rsa_sign_fdh priv msg =
-    let pub = Rsa.pub_of_priv priv in
-    let r = rsa_full_domain_hash pub msg in
-    rsa_sign_z priv r
-
-  let rsa_unblind pub ~bks ~sig_ =
-    let bkey = rsa_blinding_key_derive pub bks in
-    let r_inv =
-      try Z.invert bkey pub.n
-      with Division_by_zero ->
-        (* => gcd(r,n) <> 1, should be already checked for *)
-        assert false
-    in
-    let ubsig = Z.rem (Z.mul sig_ r_inv) pub.n in
-    ubsig
-
-  let rsa_verify pub ~msg ~sig_ =
-    let r = rsa_full_domain_hash pub msg in
-    rsa_verify_z pub r sig_
-end