From b66b9cc85719a33c7ebe01a12353b187f03143b9 Mon Sep 17 00:00:00 2001 From: swrup Date: Tue, 3 Feb 2026 17:24:19 +0100 Subject: [PATCH] ~ --- src/http_keys.ml | 4 +- tools/offline.ml | 92 ++++++++------- tools/offline_impl.ml | 45 ++++--- tools/offline_sig.ml | 268 ++++++++++++++++++++---------------------- 4 files changed, 209 insertions(+), 200 deletions(-) diff --git a/src/http_keys.ml b/src/http_keys.ml index dd924c90..9c9957d7 100644 --- a/src/http_keys.ml +++ b/src/http_keys.ml @@ -194,7 +194,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = let* global_fees = Pg.get_global_fees db_conn ~start_date:Timestamp.epoch |> unwrap_err_caqti in - let auditors = (* TODO *) [] in + let auditors = + (* TODO /management/auditors + /auditors/$AUDITOR_PUB/$H_DENOM_PUB *) [] + in let extensions = None in let extensions_sig = None in Ok diff --git a/tools/offline.ml b/tools/offline.ml index 2f9137e9..cf2adb37 100644 --- a/tools/offline.ml +++ b/tools/offline.ml @@ -2,24 +2,46 @@ open Cmdliner open Cmdliner.Term.Syntax open Offline_impl +module Arg = struct + include Arg + + let timestamp = + Arg.Conv.make ~docv:"timestamp argument" ~parser:Timestamp.of_string + ~pp:Timestamp.pp () + + let relative_time = + Arg.Conv.make ~docv:"relative time argument" + ~parser:Timestamp.Span.of_string ~pp:Timestamp.Span.pp () + + let amount = + Arg.Conv.make ~docv:"amount argument" ~parser:Amount.of_string ~pp:Amount.pp + () +end + let default_master_offline_key_file = "data/master_offline_private_key" +(* let default_response_file = "response.json" let default_request_file = "request.json" +*) -(*let to_term_ret = function Error e -> `Error (false, e) | Ok () -> `Ok ()*) -let to_term_ret = Fun.id +let master_key = + let doc = "Master offline Eddsa private key file." in + Arg.( + value + & opt file default_master_offline_key_file + & info [ "master_key_file" ] ~doc) -let timestamp = - Arg.Conv.make ~docv:"timestamp argument" ~parser:Timestamp.of_string - ~pp:Timestamp.pp () +let input = + let doc = "input file" in + Arg.(required & opt (some file) None & info [ "i"; "input" ] ~doc) -let relative_time = - Arg.Conv.make ~docv:"relative time argument" ~parser:Timestamp.Span.of_string - ~pp:Timestamp.Span.pp () +let output = + let doc = "output file" in + Arg.(required & opt (some filepath) None & info [ "o"; "output" ] ~doc) -let amount = - Arg.Conv.make ~docv:"amount argument" ~parser:Amount.of_string ~pp:Amount.pp - () +let url = + let doc = "url" in + Arg.(required & opt (some string) None & info [ "url" ] ~doc) let setup_cmd = let doc = "Generate offline master keys" in @@ -33,56 +55,31 @@ let setup_cmd = Cmd.make (Cmd.info "setup" ~doc) @@ let+ output = output in - setup ~output |> to_term_ret + setup ~output let download_cmd = let doc = "GET /management/keys/" in let man = [ `S Manpage.s_description; `P "$(cmd) download /management/keys." ] in - let output = - let doc = "output file" in - Arg.( - value & opt filepath default_response_file & info [ "o"; "output" ] ~doc) - in Cmd.make (Cmd.info "download" ~doc ~man) @@ let+ output = output in - download ~output |> to_term_ret + download ~output let upload_cmd = let doc = "POST input.json data to url (default /management/keys)" in - let input = - let doc = "input file" in - Arg.(value & opt file default_request_file & info [ "i"; "input" ] ~doc) - in - let url = - let doc = "url" in - Arg.(value & opt string "/management/keys" & info [ "url" ] ~doc) - in Cmd.make (Cmd.info "upload" ~doc) @@ let+ input = input and+ url = url in - upload ~input ~url |> to_term_ret - -let master_key = - let doc = "Master offline Eddsa private key file." in - Arg.(value & opt file default_master_offline_key_file & info [ "key" ] ~doc) - -let input = - let doc = "input file" in - Arg.(value & opt file default_response_file & info [ "i"; "input" ] ~doc) - -let output = - let doc = "output file" in - Arg.(value & opt filepath default_request_file & info [ "o"; "output" ] ~doc) + upload ~input ~url let sign_cmd = let doc = "Sign FutureKeysResponse." in Cmd.make (Cmd.info "sign" ~doc) @@ let+ input = input and+ output = output and+ master_key = master_key in - sign ~input ~output ~master_key |> to_term_ret + sign ~input ~output ~master_key let revoke_denom_cmd = let doc = "Revoke denomination." in @@ -93,7 +90,7 @@ let revoke_denom_cmd = Cmd.make (Cmd.info "revoke-denom" ~doc) @@ let+ output = output and+ master_key = master_key and+ h_denom = h_denom in - revoke_denom ~output ~master_key ~h_denom |> to_term_ret + revoke_denom ~output ~master_key ~h_denom let revoke_signkey_cmd = let doc = "Revoke signkey." in @@ -104,7 +101,7 @@ let revoke_signkey_cmd = Cmd.make (Cmd.info "revoke-signkey" ~doc) @@ let+ output = output and+ master_key = master_key and+ signkey = signkey in - revoke_signkey ~output ~master_key ~signkey |> to_term_ret + revoke_signkey ~output ~master_key ~signkey let global_fees_cmd = let doc = "Provides global fee configuration." in @@ -148,7 +145,6 @@ let global_fees_cmd = global_fees ~output ~master_key ~start_date ~end_date ~history_fee ~account_fee ~purse_fee ~history_expiration ~purse_account_limit ~purse_timeout - |> to_term_ret let cli = let info = @@ -168,3 +164,13 @@ let cli = let main () = Cmd.eval_result cli let () = if !Sys.interactive then () else exit (main ()) + +(* TODO all management operations: + /management/auditors + /management/auditors/$AUDITOR_PUB/disable + /management/wire-fee + /management/wire + /management/wire/disable + /management/drain + /management/aml-officers + /management/partners *) diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml index 2ad704ba..48f4cbbe 100644 --- a/tools/offline_impl.ml +++ b/tools/offline_impl.ml @@ -5,6 +5,10 @@ let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg let write_file fname content = Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg +let read_master_key_file filename = + let* master_key = read_file filename in + Crypto.EddsaPrivateKey.of_octets master_key + let base_url = Uri.of_string "http://localhost:3434/" let full_url path = Uri.with_path base_url path |> Uri.to_string @@ -40,39 +44,46 @@ let setup ~output = let sign ~master_key ~input ~output = let open Crypto in + let* master_key = read_master_key_file master_key in let* input = read_file input in - let* master_key = read_file master_key in - let* master_key = EddsaPrivateKey.of_octets master_key in let master_pub = EddsaPrivateKey.pub_of_priv master_key in let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in let* () = Offline_sig.verify_future_keys_response master_pub future_keys_response in let master_signatures = - Offline_sig.make_master_signatures ~master_key future_keys_response + Offline_sig.mk_future_keys ~master_key future_keys_response in let* s = Api.encode Api.MasterSignatures.jsont master_signatures in let* () = write_file output s in Ok () let revoke_denom ~output ~master_key ~h_denom = - let open Crypto in - let* key = read_file master_key in - let* key = EddsaPrivateKey.of_octets key in + let* key = read_master_key_file master_key in let* h_denom = B32.decode h_denom in - let h_denom = Bin_type.DenominationHash.of_octets h_denom in - let denom_revoke = Offline_sig.mk_denom_revoke ~key h_denom in + let h_denom_pub = Bin_type.DenominationHash.of_octets h_denom in + let denom_revoke = + let master_sig = + let open Bin_sig.MasterDenominationKeyRevocation in + sign_f ~f:(Crypto.EddsaSignature.sign ~key) { h_denom_pub } + in + Api.DenomRevocationSignature.{ master_sig } + in let* s = Api.encode Api.DenomRevocationSignature.jsont denom_revoke in let* () = write_file output s in Ok () let revoke_signkey ~output ~master_key ~signkey = - let open Crypto in - let* key = read_file master_key in - let* key = EddsaPrivateKey.of_octets key in - let* signkey = EddsaPublicKey.of_b32 signkey in - let v = Offline_sig.mk_signkey_revoke ~key signkey in - let* s = Api.encode Api.SignkeyRevocationSignature.jsont v in + let* key = read_master_key_file master_key in + let* exchange_pub = Crypto.EddsaPublicKey.of_b32 signkey in + let signkey_revoke = + let master_sig = + let open Bin_sig.MasterSigningKeyRevocation in + sign_f ~f:(Crypto.EddsaSignature.sign ~key) { exchange_pub } + in + Api.SignkeyRevocationSignature.{ master_sig } + in + let* s = Api.encode Api.SignkeyRevocationSignature.jsont signkey_revoke in let* () = write_file output s in Ok () @@ -80,8 +91,7 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee ~account_fee ~purse_fee ~history_expiration ~purse_account_limit ~purse_timeout = let open Crypto in - let* key = read_file master_key in - let* key = EddsaPrivateKey.of_octets key in + let* key = read_master_key_file master_key in let* purse_account_limit = match purse_account_limit >= 0 @@ -124,5 +134,4 @@ let global_fees ~output ~master_key ~start_date ~end_date ~history_fee } in let* s = Api.encode Api.GlobalFees.jsont global_fees in - let* () = write_file output s in - Ok () + write_file output s diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml index eaeda431..0c07ce22 100644 --- a/tools/offline_sig.ml +++ b/tools/offline_sig.ml @@ -2,116 +2,49 @@ open Crypto open Bin_type open Api -let denom_signature ~master_key - FutureDenom. - { - section_name= _; - value; - stamp_start; - stamp_expire_withdraw; - stamp_expire_deposit; - stamp_expire_legal; - denom_pub; - fee_withdraw; - fee_deposit; - fee_refresh; - fee_refund= _; - denom_secmod_sig= _; - } = - let octets = DenominationKey.to_octets denom_pub in - let h_denom_pub = DenominationHash.hash octets in - let master_sig = - let open Bin_sig.DenominationKeyValidity in - let master = EddsaPrivateKey.(pub_of_priv master_key) in - sign_f - ~f:(EddsaSignature.sign ~key:master_key) - { - master; - start= stamp_start; - expire_withdraw= stamp_expire_withdraw; - expire_spend= stamp_expire_deposit; - expire_legal= stamp_expire_legal; - value; - fee_withdraw; - fee_deposit; - fee_refresh; - denom_hash= h_denom_pub; - } +let verify_future_keys_response = + let verify_future_denom ~sm_denom_pub + FutureDenom. + { + section_name; + value= _; + stamp_start; + stamp_expire_withdraw; + stamp_expire_deposit= _; + stamp_expire_legal= _; + denom_pub; + fee_withdraw= _; + fee_deposit= _; + fee_refresh= _; + fee_refund= _; + denom_secmod_sig; + } = + let h_denom_pub = + DenominationHash.hash (DenominationKey.to_octets denom_pub) + in + let h_section_name = Hash_64_cstr.hash section_name in + let anchor_time = stamp_start in + let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in + let open Bin_sig.DenominationKeyAnnouncement in + verify_f + ~f:(EddsaSignature.verify ~key:sm_denom_pub) + denom_secmod_sig + { h_denom_pub; h_section_name; anchor_time; duration_withdraw } in - DenomSignature.{ h_denom_pub; master_sig } - -let signkey_signature ~master_key - FutureSignKey. - { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } = - let master_sig = - let open Bin_sig.ExchangeSigningKeyValidity in - sign_f - ~f:(EddsaSignature.sign ~key:master_key) - { - start= stamp_start; - expire= stamp_expire; - end_= stamp_end; - signkey_pub= key; - } + let verify_future_signkey ~sm_signkey_pub + FutureSignKey. + { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } = + let exchange_pub = key in + let anchor_time = stamp_start in + let duration = Timestamp.diff stamp_start stamp_expire in + let open Bin_sig.SigningKeyAnnouncement in + verify_f + ~f:(EddsaSignature.verify ~key:sm_signkey_pub) + signkey_secmod_sig + { exchange_pub; anchor_time; duration } in - SignKeySignature.{ key; master_sig } -let make_master_signatures ~master_key - FutureKeysResponse. - { - future_denoms; - future_signkeys; - master_pub= _; - denom_secmod_public_key= _; - signkey_secmod_public_key= _; - } = - let denom_sigs = List.map (denom_signature ~master_key) future_denoms in - let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in - MasterSignatures.{ denom_sigs; signkey_sigs } - -(* - ** - *) - -let verify_future_signkey ~sm_signkey_pub - FutureSignKey. - { key; stamp_start; stamp_expire; stamp_end= _; signkey_secmod_sig } = - let exchange_pub = key in - let anchor_time = stamp_start in - let duration = Timestamp.diff stamp_start stamp_expire in - let open Bin_sig.SigningKeyAnnouncement in - verify_f - ~f:(EddsaSignature.verify ~key:sm_signkey_pub) - signkey_secmod_sig - { exchange_pub; anchor_time; duration } - -let verify_future_denom ~sm_denom_pub - FutureDenom. - { - section_name; - value= _; - stamp_start; - stamp_expire_withdraw; - stamp_expire_deposit= _; - stamp_expire_legal= _; - denom_pub; - fee_withdraw= _; - fee_deposit= _; - fee_refresh= _; - fee_refund= _; - denom_secmod_sig; - } = - let h_denom_pub = - DenominationHash.hash (DenominationKey.to_octets denom_pub) - in - let h_section_name = Hash_64_cstr.hash section_name in - let anchor_time = stamp_start in - let duration_withdraw = Timestamp.diff stamp_start stamp_expire_withdraw in - let open Bin_sig.DenominationKeyAnnouncement in - verify_f - ~f:(EddsaSignature.verify ~key:sm_denom_pub) - denom_secmod_sig - { h_denom_pub; h_section_name; anchor_time; duration_withdraw } - -let verify_future_keys_response our_master_public_key + fun our_master_public_key FutureKeysResponse. { future_denoms; @@ -119,37 +52,96 @@ let verify_future_keys_response our_master_public_key master_pub; denom_secmod_public_key; signkey_secmod_public_key; - } = - let open Syntax in - let* () = - match master_pub = our_master_public_key with - | false -> - Fmt.error - "master public key of the future key response does not match ours" - | true -> Ok () - in - let* () = - list_iter - (verify_future_denom ~sm_denom_pub:denom_secmod_public_key) - future_denoms - in - let* () = - list_iter - (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key) - future_signkeys - in - Ok () + } + -> + let open Syntax in + let* () = + match master_pub = our_master_public_key with + | false -> + Fmt.error + "master public key of the future key response does not match ours" + | true -> Ok () + in + let* () = + list_iter + (verify_future_denom ~sm_denom_pub:denom_secmod_public_key) + future_denoms + in + let* () = + list_iter + (verify_future_signkey ~sm_signkey_pub:signkey_secmod_public_key) + future_signkeys + in + Ok () -let mk_denom_revoke ~key h_denom_pub = - let master_sig = - let open Bin_sig.MasterDenominationKeyRevocation in - sign_f ~f:(EddsaSignature.sign ~key) { h_denom_pub } +let mk_future_keys = + let denom_signature ~master_key + FutureDenom. + { + section_name= _; + value; + stamp_start; + stamp_expire_withdraw; + stamp_expire_deposit; + stamp_expire_legal; + denom_pub; + fee_withdraw; + fee_deposit; + fee_refresh; + fee_refund= _; + denom_secmod_sig= _; + } = + let octets = DenominationKey.to_octets denom_pub in + let h_denom_pub = DenominationHash.hash octets in + let master_sig = + let open Bin_sig.DenominationKeyValidity in + let master = EddsaPrivateKey.(pub_of_priv master_key) in + sign_f + ~f:(EddsaSignature.sign ~key:master_key) + { + master; + start= stamp_start; + expire_withdraw= stamp_expire_withdraw; + expire_spend= stamp_expire_deposit; + expire_legal= stamp_expire_legal; + value; + fee_withdraw; + fee_deposit; + fee_refresh; + denom_hash= h_denom_pub; + } + in + DenomSignature.{ h_denom_pub; master_sig } + in + let signkey_signature ~master_key + FutureSignKey. + { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig= _ } = + let master_sig = + let open Bin_sig.ExchangeSigningKeyValidity in + sign_f + ~f:(EddsaSignature.sign ~key:master_key) + { + start= stamp_start; + expire= stamp_expire; + end_= stamp_end; + signkey_pub= key; + } + in + SignKeySignature.{ key; master_sig } in - DenomRevocationSignature.{ master_sig } -let mk_signkey_revoke ~key exchange_pub = - let master_sig = - let open Bin_sig.MasterSigningKeyRevocation in - sign_f ~f:(EddsaSignature.sign ~key) { exchange_pub } - in - SignkeyRevocationSignature.{ master_sig } + fun ~master_key + FutureKeysResponse. + { + future_denoms; + future_signkeys; + master_pub= _; + denom_secmod_public_key= _; + signkey_secmod_public_key= _; + } + -> + let denom_sigs = List.map (denom_signature ~master_key) future_denoms in + let signkey_sigs = + List.map (signkey_signature ~master_key) future_signkeys + in + MasterSignatures.{ denom_sigs; signkey_sigs }