swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add revoked_sig option to sk/dn_data

Browse source
This commit is contained in:
swrup 2025-12-21 20:06:01 +01:00
parent 8f433fcb28
commit 9a68d18a1d
7 changed files with 45 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

52
src/secmod.ml
View file

@ -24,14 +24,8 @@ type t = {
sm_key_priv: eddsa_priv;
sm_key_pub: eddsa_pub;
sk_ht: (eddsa_pub, signkey) Hashtbl.t;
sk_revoked_ht:
(eddsa_pub, signkey * Bin_sig.MasterSigningKeyRevocation.t) Hashtbl.t;
dn_ht: (denomination_hash, denom) Hashtbl.t;
dn_section_name_ht: (denomination_hash, string) Hashtbl.t;
dn_revoked_ht:
( denomination_hash,
denom * Bin_sig.MasterDenominationKeyRevocation.t )
Hashtbl.t;
}
(* note: don't expose a signing function if we want a real "security module" one day *)
@ -116,22 +110,24 @@ let add_denom_master_signatures conn t l =
Ok ())
l
let revoke_signkey t exchange_pub master_sig =
let revoke_signkey t exchange_pub revoked_sig =
Miou.Mutex.protect t.lock @@ fun () ->
match Hashtbl.find_opt t.sk_ht exchange_pub with
| None -> Error "secmod failure: denomination hash not found."
| Some signkey ->
Hashtbl.remove t.sk_ht exchange_pub;
Hashtbl.replace t.sk_revoked_ht exchange_pub (signkey, master_sig);
let sk_data = { signkey.sk_data with revoked_sig= Some revoked_sig } in
let signkey = { signkey with sk_data } in
Hashtbl.replace t.sk_ht exchange_pub signkey;
Ok ()
let revoke_denomination t h_denom_pub master_sig =
let revoke_denomination t h_denom_pub revoked_sig =
Miou.Mutex.protect t.lock @@ fun () ->
match Hashtbl.find_opt t.dn_ht h_denom_pub with
| None -> Error "secmod failure: denomination hash not found."
| Some denom ->
Hashtbl.remove t.dn_ht h_denom_pub;
Hashtbl.replace t.dn_revoked_ht h_denom_pub (denom, master_sig);
let dn_data = { denom.dn_data with revoked_sig= Some revoked_sig } in
let denom = { denom with dn_data } in
Hashtbl.replace t.dn_ht h_denom_pub denom;
Ok ()
let dir = Fpath.(v "data" / "secmod ")
@ -236,20 +232,9 @@ let load conn =
|> List.to_seq
|> Hashtbl.of_seq
in
let sk_revoked_ht = Hashtbl.create 0xff in
let dn_revoked_ht = Hashtbl.create 0xff in
Ok
(Some
{
lock;
sm_key_priv;
sm_key_pub;
sk_ht;
sk_revoked_ht;
dn_ht;
dn_section_name_ht;
dn_revoked_ht;
})
{ lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht })
| _, _, _ -> error_invalid_state
let make_new_signkey () =
@ -261,8 +246,10 @@ let make_new_signkey () =
let stamp_end = stamp_expire in
let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
let master_sig = None in
let revoked_sig = None in
let sk_data =
Signkey_data.{ pub; stamp_start; stamp_expire; stamp_end; master_sig }
Signkey_data.
{ pub; stamp_start; stamp_expire; stamp_end; master_sig; revoked_sig }
in
{ priv; sk_data }
@ -296,6 +283,7 @@ let make_new_denom
let priv, pub = RsaPrivateKey.generate ~bits:rsa_keysize () in
let h_pub = Bin_type.DenominationHash.hash (RsaPublicKey.to_octets pub) in
let master_sig = None in
let revoked_sig = None in
let dn_data =
Denom_data.
{
@ -312,6 +300,7 @@ let make_new_denom
age_mask= 0;
h_pub;
master_sig;
revoked_sig;
}
in
{ priv; dn_data }
@ -335,18 +324,7 @@ let make_new () =
|> List.to_seq
|> Hashtbl.of_seq
in
let sk_revoked_ht = Hashtbl.create 0xff in
let dn_revoked_ht = Hashtbl.create 0xff in
{
lock;
sm_key_priv;
sm_key_pub;
sk_ht;
sk_revoked_ht;
dn_ht;
dn_section_name_ht;
dn_revoked_ht;
}
{ lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht }
let init conn =
match load conn with