From b719f9b9c74ed430a41621e04662d152537f9170 Mon Sep 17 00:00:00 2001 From: swrup Date: Wed, 18 Feb 2026 17:26:53 +0100 Subject: [PATCH] rename --- src/crypto.ml | 24 +++++------ src/devices.ml | 2 +- src/http_information.ml | 10 +++-- src/http_management.ml | 84 ++++++++++++++++++------------------ src/{secmod.ml => keys.ml} | 36 ++++++++-------- src/{secmod.mli => keys.mli} | 0 src/signatures.ml | 11 +++-- 7 files changed, 82 insertions(+), 85 deletions(-) rename src/{secmod.ml => keys.ml} (92%) rename src/{secmod.mli => keys.mli} (100%) diff --git a/src/crypto.ml b/src/crypto.ml index aac1d07d..99cabfea 100644 --- a/src/crypto.ml +++ b/src/crypto.ml @@ -159,37 +159,35 @@ end = struct binary-encoded objects with just the R and S values *) type t = string - (* mirage_crypto: "The result is the concatenation of r and s, as specified in RFC 8032." *) + (* mirage_crypto: + "The result is the concatenation of r and s, as specified in RFC 8032." *) let sign ~key s = Mirage_crypto_ec.Ed25519.sign ~key s let verify ~key s ~msg = let b = Mirage_crypto_ec.Ed25519.verify ~key s ~msg in match b with - | false -> Error "signature verification failure: invalid signature" + | false -> Error "EddsaSignature verification: invalid signature" | true -> Ok () let to_octets t = t + let check_size t = + match String.length t = 64 with + | false -> Error "EddsaSignature of_octets: data is not 64 bytes." + | true -> Ok () + let of_octets v = - match String.length v = 64 with - | false -> - Fmt.error "EddsaSignature.of_octets failure: data is not 64 bytes." - | true -> Ok v + let+ () = check_size v in + v let bin = let of_octets_exn t = of_octets t |> Result.get_ok in Bin.map (Bin.bytes 64) of_octets_exn to_octets - let check_size t = - match String.length t = 64 with - | false -> Error "EddsaSignature: invalid string length" - | true -> Ok () - let jsont = let of_b32 s = let* t = B32.decode s in - let+ () = check_size t in - t + of_octets t in let to_b32 = B32.encode in Jsont.of_of_string ~kind:"EddsaSignature" of_b32 ~enc:to_b32 diff --git a/src/devices.ml b/src/devices.ml index 7da26428..c37d5f76 100644 --- a/src/devices.ml +++ b/src/devices.ml @@ -22,5 +22,5 @@ let secmod = let finally _key = () in Vif.Device.v ~name:"secmod" ~finally [ Vif.Device.value db_connection ] @@ fun (module Conn : Pg.CONN) (_env : env) -> - let sm : (module Secmod.S) = (module Secmod.Make (Conn)) in + let sm : (module Keys.S) = (module Keys.Make (Conn)) in sm diff --git a/src/http_information.ml b/src/http_information.ml index 17186d5a..8d480d3a 100644 --- a/src/http_information.ml +++ b/src/http_information.ml @@ -59,7 +59,7 @@ let denomgroup_of_denomdata RsaDenomGroup. { denoms; value; fee_withdraw; fee_deposit; fee_refresh; fee_refund } -let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = +let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date = let version = Api.protocol_version in let base_url = Config.base_url in let currency = Config.currency in @@ -113,7 +113,7 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = let zero_limits = [] in let dn_l = (*Pg.get_denominations db_conn |> unwrap_err_caqti *) - Sm.get_denominations () + Keys.get_denominations () |> (* reverse chronological order *) List.sort (fun a b -> @@ -151,7 +151,7 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = (* let now = Ptime_clock.now () |> Option.some in let+ signkey_data_l = Pg.get_active_signkeys db_conn ~now |> unwrap_err_caqti in*) - Sm.get_signkeys () + Keys.get_signkeys () |> List.sort (fun a b -> let open Signkey in Stdlib.compare b.stamp_start a.stamp_start) @@ -176,7 +176,9 @@ let mk_keys ~db_conn (module Sm : Secmod.S) ~last_issue_date = |> Hash.H64.hash in let open Signatures.ExchangeKeySet in - sign_f ~f:(Sm.sign_with_signkey ~pub:exchange_pub) R.{ list_issue_date; hc } + sign_f + ~f:(Keys.sign_with_signkey ~pub:exchange_pub) + R.{ list_issue_date; hc } in let recoup = (* TODO /recoup *) [] in diff --git a/src/http_management.ml b/src/http_management.ml index 6e739205..9ba83b1b 100644 --- a/src/http_management.ml +++ b/src/http_management.ml @@ -3,12 +3,12 @@ open Api open Hash module Keys_get = struct - let mk_future_keys_response (module Sm : Secmod.S) = - let future_signkeys = Sm.get_future_signkeys () in - let future_denoms = Sm.get_future_denominations () in + let mk_future_keys_response (module Keys : Keys.S) = + let future_signkeys = Keys.get_future_signkeys () in + let future_denoms = Keys.get_future_denominations () in let master_pub = Config.Exchange.master_public_key in - let denom_secmod_public_key = Sm.sm_pubkey in - let signkey_secmod_public_key = Sm.sm_pubkey in + let denom_secmod_public_key = Keys.sm_pubkey in + let signkey_secmod_public_key = Keys.sm_pubkey in FutureKeysResponse. { future_denoms; @@ -36,10 +36,10 @@ module Keys_post = struct "404 not found, One of the keys for which a signature was provided is \ unknown to the exchange." - let verify_denom_signature (module Sm : Secmod.S) + let verify_denom_signature (module Keys : Keys.S) DenomSignature.{ h_denom_pub; master_sig } = let* denom = - Sm.find_future_denomination h_denom_pub + Keys.find_future_denomination h_denom_pub |> Option.to_result ~none:error_key_unknown in let open Signatures.DenominationKeyValidity in @@ -58,12 +58,12 @@ module Keys_post = struct denom_hash= h_denom_pub; } in - verify_f ~f:Sm.verify_with_master_key master_sig r + verify_f ~f:Keys.verify_with_master_key master_sig r - let verify_signkey_signature (module Sm : Secmod.S) + let verify_signkey_signature (module Keys : Keys.S) SignKeySignature.{ key; master_sig } = let* signkey = - Sm.find_future_signkey key |> Option.to_result ~none:error_key_unknown + Keys.find_future_signkey key |> Option.to_result ~none:error_key_unknown in let open Signatures.ExchangeSigningKeyValidity in let r : r = @@ -74,28 +74,28 @@ module Keys_post = struct signkey_pub= signkey.key; } in - verify_f ~f:Sm.verify_with_master_key master_sig r + verify_f ~f:Keys.verify_with_master_key master_sig r let verify sm MasterSignatures.{ denom_sigs; signkey_sigs } = let* () = list_iter (verify_denom_signature sm) denom_sigs in let* () = list_iter (verify_signkey_signature sm) signkey_sigs in Ok () - let do_ ~db_conn:_ (module Sm : Secmod.S) + let do_ ~db_conn:_ (module Keys : Keys.S) MasterSignatures.{ denom_sigs; signkey_sigs } = let* () = list_iter (fun SignKeySignature.{ key; master_sig } -> - Sm.certify_future_signkey key ~master_sig) + Keys.certify_future_signkey key ~master_sig) signkey_sigs in let* () = list_iter (fun DenomSignature.{ h_denom_pub; master_sig } -> - Sm.certify_future_denomination h_denom_pub ~master_sig) + Keys.certify_future_denomination h_denom_pub ~master_sig) denom_sigs in - let* () = Sm.save () in + let* () = Keys.save () in Ok () let jsont = MasterSignatures.jsont @@ -114,14 +114,14 @@ module Keys_post = struct end module Denom_revoke = struct - let verify (module Sm : Secmod.S) h_denom_pub + let verify (module Keys : Keys.S) h_denom_pub DenomRevocationSignature.{ master_sig } = let open Signatures.MasterDenominationKeyRevocation in - verify_f ~f:Sm.verify_with_master_key master_sig { h_denom_pub } + verify_f ~f:Keys.verify_with_master_key master_sig { h_denom_pub } - let do_ ~db_conn (module Sm : Secmod.S) h_denom_pub + let do_ ~db_conn (module Keys : Keys.S) h_denom_pub DenomRevocationSignature.{ master_sig } = - let* () = Sm.revoke_denomination h_denom_pub master_sig in + let* () = Keys.revoke_denomination h_denom_pub master_sig in let+ () = Pg.insert_denomination_revocation db_conn h_denom_pub master_sig |> unwrap_err_caqti @@ -145,14 +145,14 @@ module Denom_revoke = struct end module Signkey_revoke = struct - let verify (module Sm : Secmod.S) exchange_pub + let verify (module Keys : Keys.S) exchange_pub SignkeyRevocationSignature.{ master_sig } = let open Signatures.MasterSigningKeyRevocation in - verify_f ~f:Sm.verify_with_master_key master_sig { exchange_pub } + verify_f ~f:Keys.verify_with_master_key master_sig { exchange_pub } - let do_ ~db_conn (module Sm : Secmod.S) exchange_pub + let do_ ~db_conn (module Keys : Keys.S) exchange_pub SignkeyRevocationSignature.{ master_sig } = - let* () = Sm.revoke_signkey exchange_pub master_sig in + let* () = Keys.revoke_signkey exchange_pub master_sig in let+ () = Pg.insert_signkey_revocation db_conn exchange_pub master_sig |> unwrap_err_caqti @@ -176,7 +176,7 @@ module Signkey_revoke = struct end module Auditors = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) AuditorSetupMessage. { auditor_url; @@ -186,7 +186,7 @@ module Auditors = struct validity_start; } = let open Signatures.MasterAddAuditor in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { start_date= validity_start; auditor_pub; @@ -230,10 +230,10 @@ module Auditors = struct end module Auditors_disable = struct - let verify (module Sm : Secmod.S) auditor_pub + let verify (module Keys : Keys.S) auditor_pub AuditorTeardownMessage.{ master_sig; validity_end } = let open Signatures.MasterDelAuditor in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { end_date= validity_end; auditor_pub } let do_ ~db_conn auditor_pub @@ -271,7 +271,7 @@ module Auditors_disable = struct end module Wire_fee = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) WireFeeSetupMessage. { wire_method; @@ -282,7 +282,7 @@ module Wire_fee = struct wire_fee; } = let open Signatures.MasterWireFee in - verify_f ~f:Sm.verify_with_master_key master_sig_wire + verify_f ~f:Keys.verify_with_master_key master_sig_wire { h_wire_method= Hash.Cstring.H64.hash wire_method; start_date= fee_start; @@ -330,7 +330,7 @@ module Wire_fee = struct end module Global_fees = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) GlobalFees. { start_date; @@ -344,7 +344,7 @@ module Global_fees = struct master_sig; } = let open Signatures.GlobalFees in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { start_date; end_date; @@ -401,7 +401,7 @@ module Global_fees = struct end module Wire = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) WireSetupMessage. { payto_uri; @@ -417,7 +417,7 @@ module Wire = struct let debit_restrictions = "" in let* () = let open Signatures.MasterWireDetails in - verify_f ~f:Sm.verify_with_master_key master_sig_wire + verify_f ~f:Keys.verify_with_master_key master_sig_wire { h_wire_details= FullPaytoHash.hash payto_uri; h_conversion_url= Hash.Cstring.H64.hash conversion_url; @@ -427,7 +427,7 @@ module Wire = struct in let* () = let open Signatures.MasterAddWire in - verify_f ~f:Sm.verify_with_master_key master_sig_add + verify_f ~f:Keys.verify_with_master_key master_sig_add { start_date= validity_start; h_wire= FullPaytoHash.hash payto_uri; @@ -480,10 +480,10 @@ module Wire = struct end module Wire_disable = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) WireTeardownMessage.{ payto_uri; master_sig_del; validity_end } = let open Signatures.MasterDelWire in - verify_f ~f:Sm.verify_with_master_key master_sig_del + verify_f ~f:Keys.verify_with_master_key master_sig_del { end_date= validity_end; h_wire= FullPaytoHash.hash payto_uri } let do_ ~db_conn @@ -515,7 +515,7 @@ module Wire_disable = struct end module Drain = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) DrainProfitsMessage. { debit_account_section; @@ -526,7 +526,7 @@ module Drain = struct amount; } = let open Signatures.MasterDrainProfit in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { wtid; date; @@ -555,7 +555,7 @@ module Drain = struct end module AmlOfficer = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) AmlOfficerSetup. { officer_pub; @@ -567,7 +567,7 @@ module AmlOfficer = struct } = let open Signatures.MasterAmlOfficerStatus in let is_active = match is_active with true -> 1_l | false -> 0_l in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { change_date; officer_pub; @@ -595,7 +595,7 @@ module AmlOfficer = struct end module Partners = struct - let verify (module Sm : Secmod.S) + let verify (module Keys : Keys.S) ExchangePartnerSetupRequest. { partner_base_url; @@ -607,7 +607,7 @@ module Partners = struct wad_fee; } = let open Signatures.PartnerConfiguration in - verify_f ~f:Sm.verify_with_master_key master_sig + verify_f ~f:Keys.verify_with_master_key master_sig { partner_pub; start_date; diff --git a/src/secmod.ml b/src/keys.ml similarity index 92% rename from src/secmod.ml rename to src/keys.ml index a9c980fc..44532ccb 100644 --- a/src/secmod.ml +++ b/src/keys.ml @@ -205,13 +205,13 @@ module Make (Conn : Pg.CONN) = struct let database_find_sk conn pub = let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in match opt with - | None -> Fmt.error "secmod: signkey data not found in database" + | None -> Fmt.error "Keys: signkey data not found in database" | Some sk_data -> Ok sk_data let database_find_dn conn h_pub = let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in match opt with - | None -> Fmt.error "secmod: denomination data not found in database" + | None -> Fmt.error "Keys: denomination data not found in database" | Some dn_data -> Ok dn_data let list_to_ht l = Hashtbl.of_seq (List.to_seq l) @@ -282,25 +282,24 @@ module Make (Conn : Pg.CONN) = struct let init () = let dir = Config.secmod_dir in let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in - if b then - Logs.info (fun m -> m "secmod: created directory `%a`" Fpath.pp dir); + if b then Logs.info (fun m -> m "Keys: created directory `%a`" Fpath.pp dir); let* l = Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg in match List.is_empty l with | true -> - Logs.info (fun m -> m "secmod: empty storage, generating fresh keys"); + Logs.info (fun m -> m "Keys: empty storage, generating fresh keys"); let t = make_new () in Ok t | false -> - Logs.info (fun m -> m "secmod: loading keys from storage"); + Logs.info (fun m -> m "Keys: loading keys from storage"); load () let t = match init () with - | Error e -> Fmt.failwith "secmod initialization failure: `%s`." e + | Error e -> Fmt.failwith "Keys: initialization failure: `%s`." e | Ok t -> - Logs.info (fun m -> m "secmod initialized"); + Logs.info (fun m -> m "Keys: initialized"); t let sm_pubkey = t.sm_pubkey @@ -308,7 +307,7 @@ module Make (Conn : Pg.CONN) = struct let sign_with_signkey ~pub s = match Hashtbl.find_opt t.sk_key_ht pub with - | None -> Fmt.failwith "secmod sign_with_signkey failure: not found." + | None -> Fmt.failwith "Keys sign_with_signkey failure: not found." | Some priv -> EddsaSignature.sign ~key:priv s let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg @@ -318,7 +317,7 @@ module Make (Conn : Pg.CONN) = struct let verify_with_signkey ~pub s ~msg = match Hashtbl.find_opt t.sk_ht pub with - | None -> Fmt.failwith "secmod verify_with_signkey failure: not found." + | None -> Fmt.failwith "Keys verify_with_signkey failure: not found." | Some _sk -> EddsaSignature.verify ~key:pub s ~msg let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq @@ -341,10 +340,10 @@ module Make (Conn : Pg.CONN) = struct Hashtbl.find_opt t.future_sk_key_ht pub ) with | None, _ | _, None -> - Error "secmod certify_future_signkey: future signkey not found." + Error "Keys certify_future_signkey: future signkey not found." | Some future_sk, Some priv -> ( match Hashtbl.find_opt t.sk_ht pub with - | Some _sk -> Error "secmod certify_future_signkey: already certified" + | Some _sk -> Error "Keys certify_future_signkey: already certified" | None -> let Api.FutureSignKey. { @@ -381,12 +380,11 @@ module Make (Conn : Pg.CONN) = struct Hashtbl.find_opt t.future_dn_key_ht h_pub ) with | None, _ | _, None -> - Error - "secmod certify_future_denomination: future denomination not found." + Error "Keys certify_future_denomination: future denomination not found." | Some future_dn, Some priv -> ( match Hashtbl.find_opt t.dn_ht h_pub with | Some _dn -> - Error "secmod certify_future_denomination: already certified" + Error "Keys certify_future_denomination: already certified" | None -> let Api.FutureDenom. { @@ -439,7 +437,7 @@ module Make (Conn : Pg.CONN) = struct let revoke_signkey pub revoked_sig = match Hashtbl.find_opt t.sk_ht pub with - | None -> Error "secmod revoke_signkey: signkey not found." + | None -> Error "Keys revoke_signkey: signkey not found." | Some sk -> let sk = { sk with revoked_sig= Some revoked_sig } in Hashtbl.replace t.sk_ht pub sk; @@ -449,7 +447,7 @@ module Make (Conn : Pg.CONN) = struct let revoke_denomination pub revoked_sig = match Hashtbl.find_opt t.dn_ht pub with - | None -> Error "secmod revoke_denomination: denomination not found." + | None -> Error "Keys revoke_denomination: denomination not found." | Some dn -> let dn = { dn with revoked_sig= Some revoked_sig } in Hashtbl.replace t.dn_ht pub dn; @@ -470,9 +468,9 @@ module Make (Conn : Pg.CONN) = struct |> List.of_seq |> list_iter (fun (h_pub, priv) -> match Hashtbl.find_opt t.dn_section_name_ht h_pub with - | None -> Error "secmod save: invalid state, section_name not found" + | None -> Error "Keys save: invalid state, section_name not found" | Some section_name -> write_rsa (dn_fname section_name) priv) in - Logs.info (fun m -> m "saved secmod private keys data"); + Logs.info (fun m -> m "saved private keys data"); Ok () end diff --git a/src/secmod.mli b/src/keys.mli similarity index 100% rename from src/secmod.mli rename to src/keys.mli diff --git a/src/signatures.ml b/src/signatures.ml index 80cebad6..1d57405e 100644 --- a/src/signatures.ml +++ b/src/signatures.ml @@ -1,9 +1,7 @@ (* TODO signatures - check with taler-wallet-core/src/crypto/cryptoImplementation.js + check with taler-wallet check signed/unsigned ints - check endianness - - better handling of decoding failure *) + check endianness *) open Hash module Aliases = struct @@ -177,8 +175,9 @@ end = struct type r = R.r type t = EddsaSignature.t - let sign_f ~f r = f (Bin.to_string R.bin r) - let verify_f ~f t r = f t ~msg:(Bin.to_string R.bin r) + let to_string = Bin.to_string R.bin + let sign_f ~f r = f (to_string r) + let verify_f ~f t r = f t ~msg:(to_string r) let jsont = EddsaSignature.jsont let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti let to_octets t = EddsaSignature.to_octets t