diff --git a/src/api.ml b/src/api.ml index a4116cc2..48f49b1b 100644 --- a/src/api.ml +++ b/src/api.ml @@ -24,13 +24,12 @@ open Crypto open Bin_sig open Jsont.Object +module DenominationHash = Hash.DenominationHash let encode_exn jsont v = Jsont_bytesrw.encode_string jsont v |> Result.get_ok let encode jsont v = Jsont_bytesrw.encode_string jsont v let decode jsont v = Jsont_bytesrw.decode_string jsont v -module DenominationHash = Bin_type.DenominationHash - module Account_operation = struct type t = | Withdraw diff --git a/src/bin_sig.ml b/src/bin_sig.ml index 76c11e32..f961f6c4 100644 --- a/src/bin_sig.ml +++ b/src/bin_sig.ml @@ -1,6 +1,7 @@ (* Packed Signature *) open Bin_type +open Hash module Aliases = struct module Timestamp = struct diff --git a/src/bin_type.ml b/src/bin_type.ml index ee533245..8f2da2be 100644 --- a/src/bin_type.ml +++ b/src/bin_type.ml @@ -30,16 +30,6 @@ - better way to have module aliases? *) -(* TODO hash and C(ancer)-terminated strings - - - "A JSON object is canonicalized by converting it to an ASCII byte array - with the algorithm specified in RFC 8785. The resulting bytes are - terminated with a single 0-byte and then hashed with SHA512." - - from the code it looks like its the same for all stringy-strings - ! not strings that are raw-bytes-data-like - ? only for "HashCode" and "ShortHashCode" - *) - module Taler_signatures = Include.Taler_signatures let int32_size = 4 @@ -59,114 +49,6 @@ end (* -- Cryptographic primitives -- *) -(* Hashes *) - -module Hash_32 = struct - type t = Digestif.SHA256.t - - let hash s = Digestif.SHA256.(digest_string s) - - let of_octets s = - match String.length s = 32 with - | false -> Fmt.failwith "Hash.of_octets failure: data is not 32 bytes" - | true -> Digestif.SHA256.of_raw_string s - - let to_octets = Digestif.SHA256.to_raw_string - let of_b32 s = Result.map of_octets (B32.decode s) - - let bin = - let open Bin in - map (bytes 32) of_octets to_octets - - (* hashes are not b32 encoded in the database *) - let caqti : t Caqti_type.t = - let open Caqti_type in - custom - ~encode:(fun v -> Ok (to_octets v)) - ~decode:(fun v -> Ok (of_octets v)) - octets - - let jsont = - let enc v = B32.encode (to_octets v) in - Jsont.of_of_string ~kind:"Hash 32" of_b32 ~enc -end - -module Hash_64 = struct - type t = Digestif.SHA512.t - - let hash s = Digestif.SHA512.(digest_string s) - - let of_octets s = - match String.length s = 64 with - | false -> Fmt.failwith "Hash.of_octets failure: data is not 64 bytes" - | true -> Digestif.SHA512.of_raw_string s - - let to_octets v = - let s = Digestif.SHA512.to_raw_string v in - match String.length s = 64 with - | false -> Fmt.failwith "Hash.to_octets failure: data is not 64 bytes" - | true -> s - - let of_b32 s = Result.map of_octets (B32.decode s) - - let bin = - let open Bin in - map (bytes 64) of_octets to_octets - - (* hashes are not b32 encoded in the database *) - let caqti : t Caqti_type.t = - let open Caqti_type in - custom - ~encode:(fun v -> Ok (to_octets v)) - ~decode:(fun v -> Ok (of_octets v)) - octets - - let jsont = - let enc v = B32.encode (to_octets v) in - Jsont.of_of_string ~kind:"Hash 64" of_b32 ~enc -end - -(* Hash over string + '\0' *) -module Hash_32_cstr = struct - include Hash_32 - - let hash s = - let s = s ^ "\x00" in - Digestif.SHA256.(digest_string s) -end - -module Hash_64_cstr = struct - include Hash_64 - - let hash s = - let s = s ^ "\x00" in - Digestif.SHA512.(digest_string s) -end - -module type Hash_S = sig - type t - - val bin : t Bin.t - val caqti : t Caqti_type.t - val jsont : t Jsont.t - val hash : string -> t - val of_octets : string -> t - val to_octets : t -> string - val of_b32 : B32.t -> (t, string) result -end - -module FullPaytoHash : Hash_S = Hash_32 -module NormalizedPaytoHash : Hash_S = Hash_32 -module DenominationHash : Hash_S = Hash_64 -module PrivateContractHash : Hash_S = Hash_64 -module ExtensionsPolicyHash : Hash_S = Hash_64 -module MerchantWireHash : Hash_S = Hash_64 -module AgeCommitmentHash : Hash_S = Hash_64 -module BlindedCoinHash : Hash_S = Hash_64 -module CoinPubHash : Hash_S = Hash_64 -module OutputCommitmentHash : Hash_S = Hash_64 -module HashPlanchetsP : Hash_S = Hash_64 - (* --- Various --- *) module TransferSecretP = Bytes_64 diff --git a/src/crypto.ml b/src/crypto.ml index c304962b..3849c761 100644 --- a/src/crypto.ml +++ b/src/crypto.ml @@ -207,4 +207,4 @@ type eddsa_sig = EddsaSignature.t type rsa_priv = RsaPrivateKey.t type rsa_pub = RsaPublicKey.t type rsa_sig = RsaSignature.t -type denomination_hash = Bin_type.DenominationHash.t +type denomination_hash = Hash.DenominationHash.t diff --git a/src/hash.ml b/src/hash.ml new file mode 100644 index 00000000..0fbdd01a --- /dev/null +++ b/src/hash.ml @@ -0,0 +1,115 @@ +(* TODO hash: + json: + "A JSON object is canonicalized by converting it to an ASCII byte array + with the algorithm specified in RFC 8785. The resulting bytes are + terminated with a single 0-byte and then hashed with SHA512." *) +(* C-terminated strings + some strings need to be hashed with a '\0' termination char *) + +open Digestif + +module Hash_32 = struct + type t = SHA256.t + + let hash s = SHA256.(digest_string s) + + let of_octets s = + match String.length s = 32 with + | false -> Fmt.failwith "Hash.of_octets failure: data is not 32 bytes" + | true -> SHA256.of_raw_string s + + let to_octets = SHA256.to_raw_string + let of_b32 s = Result.map of_octets (B32.decode s) + + let bin = + let open Bin in + map (bytes 32) of_octets to_octets + + (* hashes are not b32 encoded in the database *) + let caqti : t Caqti_type.t = + let open Caqti_type in + custom + ~encode:(fun v -> Ok (to_octets v)) + ~decode:(fun v -> Ok (of_octets v)) + octets + + let jsont = + let enc v = B32.encode (to_octets v) in + Jsont.of_of_string ~kind:"Hash 32" of_b32 ~enc +end + +module Hash_64 = struct + type t = SHA512.t + + let hash s = SHA512.(digest_string s) + + let of_octets s = + match String.length s = 64 with + | false -> Fmt.failwith "Hash.of_octets failure: data is not 64 bytes" + | true -> SHA512.of_raw_string s + + let to_octets v = + let s = SHA512.to_raw_string v in + match String.length s = 64 with + | false -> Fmt.failwith "Hash.to_octets failure: data is not 64 bytes" + | true -> s + + let of_b32 s = Result.map of_octets (B32.decode s) + + let bin = + let open Bin in + map (bytes 64) of_octets to_octets + + (* hashes are not b32 encoded in the database *) + let caqti : t Caqti_type.t = + let open Caqti_type in + custom + ~encode:(fun v -> Ok (to_octets v)) + ~decode:(fun v -> Ok (of_octets v)) + octets + + let jsont = + let enc v = B32.encode (to_octets v) in + Jsont.of_of_string ~kind:"Hash 64" of_b32 ~enc +end + +(* Hash over string + '\0' *) +module Hash_32_cstr = struct + include Hash_32 + + let hash s = + let s = s ^ "\x00" in + SHA256.(digest_string s) +end + +module Hash_64_cstr = struct + include Hash_64 + + let hash s = + let s = s ^ "\x00" in + SHA512.(digest_string s) +end + +module type Hash_S = sig + type t + + val bin : t Bin.t + val caqti : t Caqti_type.t + val jsont : t Jsont.t + val hash : string -> t + val of_octets : string -> t + val to_octets : t -> string + val of_b32 : B32.t -> (t, string) result +end + +module FullPaytoHash : Hash_S = Hash_32 +module NormalizedPaytoHash : Hash_S = Hash_32 +module DenominationHash : Hash_S = Hash_64 +module PrivateContractHash : Hash_S = Hash_64 +module ExtensionsPolicyHash : Hash_S = Hash_64 +module MerchantWireHash : Hash_S = Hash_64 +module AgeCommitmentHash : Hash_S = Hash_64 +module BlindedCoinHash : Hash_S = Hash_64 +module CoinPubHash : Hash_S = Hash_64 +module OutputCommitmentHash : Hash_S = Hash_64 +module HashPlanchetsP : Hash_S = Hash_64 diff --git a/src/http_keys.ml b/src/http_keys.ml index ba934ecc..fb58aefe 100644 --- a/src/http_keys.ml +++ b/src/http_keys.ml @@ -182,7 +182,7 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = |> List.filter_map (fun v -> v.Denom_data.master_sig) |> List.map Bin_sig.DenominationKeyValidity.to_octets |> String.concat "" - |> Bin_type.Hash_64.hash + |> Hash.Hash_64.hash in let open Bin_sig.ExchangeKeySet in sign_f ~f:(Sm.sign_with_signkey ~pub:exchange_pub) R.{ list_issue_date; hc } diff --git a/src/http_management.ml b/src/http_management.ml index 469e1c1b..5067f7ee 100644 --- a/src/http_management.ml +++ b/src/http_management.ml @@ -1,5 +1,6 @@ open Syntax open Api +open Hash module Keys_get = struct let mk_future_denom (module Sm : Secmod.S) ~section_name @@ -26,7 +27,7 @@ module Keys_get = struct let denom_secmod_sig = let open Bin_sig.DenominationKeyAnnouncement in let h_denom_pub = h_pub in - let h_section_name = Bin_type.Hash_64_cstr.hash section_name in + let h_section_name = Hash_64_cstr.hash section_name in let anchor_time = stamp_start in let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw @@ -293,7 +294,7 @@ module Auditors = struct { start_date= validity_start; auditor_pub; - h_auditor_url= Bin_type.Hash_64_cstr.hash auditor_url; + h_auditor_url= Hash_64_cstr.hash auditor_url; } (* TODO timestamps last_change +/- checks *) @@ -389,7 +390,7 @@ module Wire_fee = struct let open Bin_sig.MasterWireFee in verify_f ~f:Sm.verify_with_master_key master_sig_wire { - h_wire_method= Bin_type.Hash_64_cstr.hash wire_method; + h_wire_method= Hash_64_cstr.hash wire_method; start_date= fee_start; end_date= fee_end; wire_fee; @@ -527,7 +528,6 @@ module Wire = struct let conversion_url = "" in let credit_restrictions = "" in let debit_restrictions = "" in - let open Bin_type in let* () = let open Bin_sig.MasterWireDetails in verify_f ~f:Sm.verify_with_master_key master_sig_wire @@ -596,7 +596,7 @@ module Wire_disable = struct WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } = let open Bin_sig.MasterDelWire in verify_f ~f:Sm.verify_with_master_key master_sig_del - { end_date= validity_end; h_wire= Bin_type.FullPaytoHash.hash payto_uri } + { end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri } let do_ ~db_conn WireTeardownMessage.{ payto_uri; master_sig_del= _; validity_end } = @@ -638,7 +638,6 @@ module Drain = struct amount; } = let open Bin_sig.MasterDrainProfit in - let open Bin_type in verify_f ~f:Sm.verify_with_master_key master_sig { wtid; @@ -684,7 +683,7 @@ module AmlOfficer = struct { change_date; officer_pub; - h_officer_name= Bin_type.Hash_64_cstr.hash officer_name; + h_officer_name= Hash_64_cstr.hash officer_name; is_active; } @@ -727,7 +726,7 @@ module Partners = struct end_date; wad_frequency; wad_fee; - h_url= Bin_type.Hash_64_cstr.hash partner_base_url; + h_url= Hash_64_cstr.hash partner_base_url; } let do_ ~db_conn v = diff --git a/src/pg_type.ml b/src/pg_type.ml index f1ed7d77..c274be25 100644 --- a/src/pg_type.ml +++ b/src/pg_type.ml @@ -1,8 +1,7 @@ (* this module defines caqti encoding/decodings *) -open Crypto -open Bin_type -open Api open Caqti_type +open Crypto +open Api (* TODO check that we use Caqti_type.octets for binary data *) @@ -32,6 +31,7 @@ let b32 = B32.caqti include struct (* alias for hash *) + open Hash let fullpayto_hash = FullPaytoHash.caqti let nomalizaedpayto_hash = NormalizedPaytoHash.caqti diff --git a/src/secmod.ml b/src/secmod.ml index f19f8aad..deb9f53b 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -86,7 +86,7 @@ module Make (Conn : Pg.CONN) = struct let db_lookup_denom_data conn ~section_name priv = let pub = RsaPrivateKey.pub_of_priv priv in - let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in + let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in match opt with | None -> @@ -209,7 +209,7 @@ module Make (Conn : Pg.CONN) = struct in let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in - let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in + let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in let master_sig = None in let revoked_sig = None in let dn_data = diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml index 304f3b54..c0c90632 100644 --- a/tools/offline_impl.ml +++ b/tools/offline_impl.ml @@ -1,4 +1,5 @@ open Syntax +open Hash let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg @@ -60,7 +61,7 @@ let sign ~master_key ~input ~output = let revoke_denom ~output ~master_key ~h_denom = let* key = read_master_key_file master_key in - let* h_denom_pub = Bin_type.DenominationHash.of_b32 h_denom in + let* h_denom_pub = DenominationHash.of_b32 h_denom in let denom_revoke = let master_sig = let open Bin_sig.MasterDenominationKeyRevocation in @@ -145,7 +146,7 @@ let enable_auditor ~output ~master_key ~auditor_url ~auditor_name ~auditor_pub { start_date= validity_start; auditor_pub; - h_auditor_url= Bin_type.Hash_64_cstr.hash auditor_url; + h_auditor_url= Hash_64_cstr.hash auditor_url; } in let v = @@ -176,7 +177,7 @@ let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee let open Bin_sig.MasterWireFee in sign_f ~f:(EddsaSignature.sign ~key) { - h_wire_method= Bin_type.Hash_64_cstr.hash wire_method; + h_wire_method= Hash_64_cstr.hash wire_method; start_date= fee_start; end_date= fee_end; closing_fee; @@ -209,8 +210,8 @@ let drain ~output ~master_key ~debit_account_section ~credit_payto_uri ~wtid wtid; date; amount; - h_section= Bin_type.Hash_64_cstr.hash debit_account_section; - h_payto= Bin_type.FullPaytoHash.hash credit_payto_uri; + h_section= Hash_64_cstr.hash debit_account_section; + h_payto= FullPaytoHash.hash credit_payto_uri; } in let v = diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml index 0c07ce22..452d027f 100644 --- a/tools/offline_sig.ml +++ b/tools/offline_sig.ml @@ -1,5 +1,5 @@ open Crypto -open Bin_type +open Hash open Api let verify_future_keys_response =