From ae3a0c90c4e9772652fec89bea2f837ed7002f04 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Tue, 24 Feb 2026 22:06:53 +0100
Subject: [PATCH] use Eqaf

---
 src/fdh_rsa.ml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/fdh_rsa.ml b/src/fdh_rsa.ml
index c66a45e9..44713d45 100644
--- a/src/fdh_rsa.ml
+++ b/src/fdh_rsa.ml
@@ -59,7 +59,6 @@ let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
 let rsa_blind pub ~bks msg =
   let data = rsa_full_domain_hash pub msg in
   let bkey = rsa_blinding_key_derive pub bks in
-  (* can we just use [powm] here instead? *)
   let r_e = Z.powm_sec bkey pub.e pub.n in
   let data_r_e = Z.rem (Z.mul data r_e) pub.n in
   Z_extra.to_octets_be data_r_e
@@ -86,13 +85,10 @@ let sign ~priv ~pub ~bks ~msg =
   let sig_ = rsa_unblind pub ~bks bsig in
   sig_
 
-(* TODO fdh-rsa
-   look into mirage-crypto for this
-   at least use Eqaf for constant time string compare *)
 let verify pub ~msg ~sig_ =
   let msg_fdh = rsa_full_domain_hash pub msg in
   let s1 = Z_extra.to_octets_be msg_fdh in
   let s2 = Mirage_crypto_pk.Rsa.encrypt ~key:pub sig_ in
-  match String.equal s1 s2 with
+  match Eqaf.equal s1 s2 with
   | false -> Fmt.error "RSA signature verification failed"
   | true -> Ok ()