src/crypto.ml

@@ -279,21 +279,60 @@ type rsa_pub = RsaPublicKey.t
 type rsa_sig = RsaSignature.t
 type denomination_hash = Hash.DenominationHash.t
 
-let rsa_full_domain_hash pub msg =
+(* WIP *)
-  let xts = RsaPublicKey.to_octets pub in
+module FDH_RSA = struct
-  let ctx = "RSA-FDA FTpsW!" in
+  module Kdf = struct
-  let r = Fdh.kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
+    module XTR = Hkdf.Make (Digestif.SHA512)
-  r
+    module PRF = Hkdf.Make (Digestif.SHA256)
 
-let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
+    let kdf ~xts ~ikm ~ctx ~len =
-  let xts = "Blinding KDF extractor HMAC key" in
+      let prk = XTR.extract ~salt:xts ikm in
-  let ctx = "Blinding KDF" in
+      let okm = PRF.expand ~prk ~info:ctx len in
-  let r = Fdh.kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
+      okm
-  r
+  end
 
-let rsa_blind pub ~bks ~msg =
+  let kdf_mod_n ~n ~xts ~ikm ~ctx =
-  let data = rsa_full_domain_hash pub msg in
+    let nbits = Z.numbits n in
-  let bkey = rsa_blinding_key_derive pub bks in
+    let len = ((nbits - 1) / 8) + 1 in
-  let r_e = Z.powm bkey pub.e pub.n in
+    assert (8 * len = nbits);
-  let data_r_e = Z.rem (Z.mul data r_e) pub.n in
+    let rec go ctr =
-  Mirage_crypto_pk.Z_extra.to_octets_be data_r_e
+      let ctr_be =
+        let b = Bytes.create 2 in
+        Bytes.set_uint16_be b 0 ctr;
+        Bytes.unsafe_to_string b
+      in
+      let ctx = String.cat ctx ctr_be in
+      let okm = Kdf.kdf ~xts ~ikm ~ctx ~len in
+      assert (String.length okm = len);
+      let r = Mirage_crypto_pk.Z_extra.of_octets_be okm in
+      if Z.gt r n then go (succ ctr) else r
+    in
+    go 0
+
+  let rsa_full_domain_hash pub msg =
+    let xts = RsaPublicKey.to_octets pub in
+    let ctx = "RSA-FDA FTpsW!" in
+    let r = kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
+    r
+
+  let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
+    let xts = "Blinding KDF extractor HMAC key" in
+    let ctx = "Blinding KDF" in
+    let r = kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
+    r
+
+  let rsa_blind pub ~bks ~msg =
+    let data = rsa_full_domain_hash pub msg in
+    let bkey = rsa_blinding_key_derive pub bks in
+    let r_e = Z.powm bkey pub.e pub.n in
+    let data_r_e = Z.rem (Z.mul data r_e) pub.n in
+    Mirage_crypto_pk.Z_extra.to_octets_be data_r_e
+
+  (*
+let rsa_sign_fdh priv msg =
+  let pub = Mirage_crypto_pk.Rsa.pub_of_priv priv in
+  let v = rsa_full_domain_hash pub msg in
+  let v = Z.to_bits v in
+  Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~crt_hardening:true ~key:priv v
+  *)
+end

src/fdh.ml

@@ -1,35 +0,0 @@
-module Kdf = struct
-  module XTR = Hkdf.Make (Digestif.SHA512)
-  module PRF = Hkdf.Make (Digestif.SHA256)
-
-  let kdf ~xts ~ikm ~ctx ~len =
-    let prk = XTR.extract ~salt:xts ikm in
-    let okm = PRF.expand ~prk ~info:ctx len in
-    okm
-end
-
-let kdf_mod_n ~n ~xts ~ikm ~ctx =
-  let nbits = Z.numbits n in
-  let len = ((nbits - 1) / 8) + 1 in
-  assert (8 * len = nbits);
-  let rec go ctr =
-    let ctr_be =
-      let b = Bytes.create 2 in
-      Bytes.set_uint16_be b 0 ctr;
-      Bytes.unsafe_to_string b
-    in
-    let ctx = String.cat ctx ctr_be in
-    let okm = Kdf.kdf ~xts ~ikm ~ctx ~len in
-    assert (String.length okm = len);
-    let r = Mirage_crypto_pk.Z_extra.of_octets_be okm in
-    if Z.gt r n then go (succ ctr) else r
-  in
-  go 0
-
-(*
-let rsa_sign_fdh priv msg =
-  let pub = Mirage_crypto_pk.Rsa.pub_of_priv priv in
-  let v = rsa_full_domain_hash pub msg in
-  let v = Z.to_bits v in
-  Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~crt_hardening:true ~key:priv v
-  *)

test/crypto.ml

@@ -89,7 +89,7 @@ let () =
   let xts = salt |> decode in
   let ikm = ikm |> decode in
   let ctx = ctx |> decode in
-  let okm = Fdh.Kdf.kdf ~xts ~ikm ~ctx ~len:out_len in
+  let okm = Crypto.FDH_RSA.Kdf.kdf ~xts ~ikm ~ctx ~len:out_len in
   let okm = okm |> encode in
   assert (okm = out);
 
@@ -114,7 +114,7 @@ let () =
     rsa_public_key |> decode |> RsaPublicKey.of_octets |> Result.get_ok
   in
   let bks = blinding_key_secret |> decode in
-  let s = rsa_blind pub ~bks ~msg |> encode in
+  let s = FDH_RSA.rsa_blind pub ~bks ~msg |> encode in
   assert (s = blinded_message);
 
   ()