swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix secmod add; + wip revoke

Browse source
This commit is contained in:
swrup 2026-02-25 00:12:05 +01:00
parent 836b9ff64a
commit 89be8fb8a4
8 changed files with 137 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

67
src/keys.ml
View file

@ -13,7 +13,7 @@ module type S = sig
val denominations : unit -> Denomination.t list result
val find_future_signkey : eddsa_pub -> Api.FutureSignKey.t result
val find_future_denomination : denom_hash -> Api.FutureDenom.t result
val make_future_keys_response : unit -> Api.FutureKeysResponse.t
val make_future_keys_response : unit -> Api.FutureKeysResponse.t result
val certify_future_signkey :
eddsa_pub -> Signatures.ExchangeSigningKeyValidity.t -> unit result
@ -68,6 +68,7 @@ module Make (Conn : Pg.CONN) : S = struct
m
"some signkeys found in database are missing from secmod, \
(unclean database/secmod state?)");
Logs.debug (fun m -> m "found %d active signkey(s)" (List.length l));
l
let denominations () =
@ -84,9 +85,12 @@ module Make (Conn : Pg.CONN) : S = struct
m
"some denominations found in database are missing from secmod, \
(unclean database/secmod state?)");
Logs.debug (fun m ->
m "found %d active denomination(s)" (List.length l));
l
let make_future_sk (pub, (start, expire)) =
Logs.debug (fun m -> m "make_future_sk: `%s`" (EddsaPublicKey.to_b32 pub));
let open Time in
let stamp_start = Timestamp.of_absolute start in
let stamp_expire = Timestamp.of_absolute expire in
@ -113,6 +117,9 @@ module Make (Conn : Pg.CONN) : S = struct
| Some v -> v
let make_future_dn (h_pub, (section_name, pub, start)) =
Logs.debug (fun m ->
m "make_future_dn: `%s`"
(B32.encode @@ Hash.DenominationHash.to_octets h_pub));
let open Time in
let Config.Coin.
{
@ -187,16 +194,37 @@ module Make (Conn : Pg.CONN) : S = struct
Ok future_dn
let make_future_keys_response () =
let future_signkeys = Sm_eddsa.keys () |> List.map make_future_sk in
let future_denoms = Sm_rsa.keys () |> List.map make_future_dn in
Api.FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= Config.Exchange.master_public_key;
denom_secmod_public_key= Sm_rsa.sm_pub;
signkey_secmod_public_key= Sm_eddsa.sm_pub;
}
let now = Timestamp.of_ptime @@ Ptime_clock.now () in
(* get keys from database to filter out keys already certified *)
let* sk_db_l = Pg.get_signkeys conn ~now |> unwrap_err_caqti in
let sk_ht = Hashtbl.create 0xff in
List.iter (fun sk -> Hashtbl.replace sk_ht sk.Signkey.pub ()) sk_db_l;
let future_signkeys =
Sm_eddsa.keys ()
|> List.filter (fun (pub, _) -> not @@ Hashtbl.mem sk_ht pub)
|> List.map make_future_sk
in
let* dn_db_l = Pg.get_denominations conn () |> unwrap_err_caqti in
let dn_ht = Hashtbl.create 0xff in
List.iter (fun dn -> Hashtbl.replace dn_ht dn.Denomination.h_pub ()) dn_db_l;
let future_denoms =
Sm_rsa.keys ()
|> List.filter (fun (h_pub, _) -> not @@ Hashtbl.mem dn_ht h_pub)
|> List.map make_future_dn
in
Logs.info (fun m ->
m "%d future signkey(s) and %d future denomination(s) to certify"
(List.length future_signkeys)
(List.length future_denoms));
Ok
Api.FutureKeysResponse.
{
future_denoms;
future_signkeys;
master_pub= Config.Exchange.master_public_key;
denom_secmod_public_key= Sm_rsa.sm_pub;
signkey_secmod_public_key= Sm_eddsa.sm_pub;
}
let sk_of_future_sk future_sk master_sig =
let Api.FutureSignKey.
@ -257,8 +285,10 @@ module Make (Conn : Pg.CONN) : S = struct
(* rebuild it *)
let future_sk = make_future_sk (pub, (t1, t2)) in
let sk = sk_of_future_sk future_sk master_sig in
let* () = Pg.insert_signkey conn sk |> unwrap_err_caqti in
Ok ())
let+ () = Pg.insert_signkey conn sk |> unwrap_err_caqti in
Logs.info (fun m ->
m "certified signkey `%s`" (EddsaPublicKey.to_b32 sk.pub));
())
let certify_future_denomination h_pub master_sig =
match Sm_rsa.find_key h_pub with
@ -272,8 +302,11 @@ module Make (Conn : Pg.CONN) : S = struct
| None ->
let future_dn = make_future_dn (h_pub, (section_name, pub, t1)) in
let dn = dn_of_future_dn future_dn h_pub master_sig in
let* () = Pg.insert_denom conn dn |> unwrap_err_caqti in
Ok ())
let+ () = Pg.insert_denom conn dn |> unwrap_err_caqti in
Logs.info (fun m ->
m "certified denomination `%s`"
(B32.encode @@ Hash.DenominationHash.to_octets dn.h_pub));
())
let revoke_signkey pub revoked_sig =
let* opt = find_signkey pub in
@ -282,6 +315,7 @@ module Make (Conn : Pg.CONN) : S = struct
let+ () =
Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_err_caqti
in
Logs.info (fun m -> m "revoked signkey `%s`" (EddsaPublicKey.to_b32 pub));
()
let revoke_denomination h_pub revoked_sig =
@ -292,5 +326,8 @@ module Make (Conn : Pg.CONN) : S = struct
Pg.insert_denomination_revocation conn dn.h_pub revoked_sig
|> unwrap_err_caqti
in
Logs.info (fun m ->
m "revoked denomination `%s`"
(B32.encode @@ Hash.DenominationHash.to_octets h_pub));
()
end