use Eqaf

src/fdh_rsa.ml

@@ -1,9 +1,6 @@
 (* WIP fdh-rsa
    full-domain-hash RSA
-   based on libgnunetutil crypto_rsa.c
-
-   good explanation of taler crypto:
-   https://www.taler.net/papers/cs-thesis.pdf *)
+   based on libgnunetutil crypto_rsa.c *)
 
 module Z_extra = Mirage_crypto_pk.Z_extra
 open Crypto
@@ -56,19 +53,14 @@ let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
   let r = Kdf.kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
   gcd_validate r pub.n; r
 
-let rsa_blind pub ~bks msg =
+let blind_msg pub ~bks msg =
   let data = rsa_full_domain_hash pub msg in
   let bkey = rsa_blinding_key_derive pub bks in
-  (* can we just use [powm] here instead? *)
   let r_e = Z.powm_sec bkey pub.e pub.n in
   let data_r_e = Z.rem (Z.mul data r_e) pub.n in
   Z_extra.to_octets_be data_r_e
 
-(* decrypt <=> sign *)
-let rsa_sign_blinded priv bmsg =
-  Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key:priv bmsg
-
-let rsa_unblind pub ~bks bsig =
+let unblind_sig pub ~bks bsig =
   let data = Z_extra.of_octets_be bsig in
   let bkey = rsa_blinding_key_derive pub bks in
   let r_inv =
@@ -80,19 +72,13 @@ let rsa_unblind pub ~bks bsig =
   let data = Z.rem (Z.mul data r_inv) pub.n in
   Z_extra.to_octets_be data
 
-let sign ~priv ~pub ~bks ~msg =
-  let bmsg = rsa_blind pub ~bks msg in
-  let bsig = rsa_sign_blinded priv bmsg in
-  let sig_ = rsa_unblind pub ~bks bsig in
-  sig_
+(* decrypt <=> sign *)
+let sign ~key bmsg = Mirage_crypto_pk.Rsa.decrypt ~crt_hardening:true ~key bmsg
 
-(* TODO fdh-rsa
-   look into mirage-crypto for this
-   at least use Eqaf for constant time string compare *)
-let verify pub ~msg ~sig_ =
-  let msg_fdh = rsa_full_domain_hash pub msg in
+let verify ~key s ~msg =
+  let msg_fdh = rsa_full_domain_hash key msg in
   let s1 = Z_extra.to_octets_be msg_fdh in
-  let s2 = Mirage_crypto_pk.Rsa.encrypt ~key:pub sig_ in
-  match String.equal s1 s2 with
+  let s2 = Mirage_crypto_pk.Rsa.encrypt ~key s in
+  match Eqaf.equal s1 s2 with
   | false -> Fmt.error "RSA signature verification failed"
   | true -> Ok ()

src/secmod_rsa.ml

@@ -259,9 +259,7 @@ module Make () = struct
 
   let sign h_pub msg =
     let+ k = find h_pub in
-    (* TODO fdh-rsa *)
-    let bks = "deadbeaf" in
-    let data = Fdh_rsa.sign ~priv:k.priv ~pub:k.pub ~bks ~msg in
+    let data = Fdh_rsa.sign ~key:k.priv msg in
     data
 
   let revoke h_pub =

test/test_crypto.ml

@@ -104,7 +104,7 @@ let () =
   in
   let bks = blinding_key_secret |> decode in
   let msg = decode message_hash in
-  let bmsg = Fdh_rsa.rsa_blind pub ~bks msg in
+  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
   assert (encode bmsg = blinded_message);
 
   ()
@@ -116,8 +116,10 @@ let () =
   let priv, pub = RsaPrivateKey.generate ~bits:2048 () in
   let bks = "deadbeaf" in
   let msg = "uhuh." in
-  let sig_ = Fdh_rsa.sign ~priv ~pub ~bks ~msg in
-  let res = Fdh_rsa.verify pub ~msg ~sig_ in
+  let bmsg = Fdh_rsa.blind_msg pub ~bks msg in
+  let bsig = Fdh_rsa.sign ~key:priv bmsg in
+  let sig_ = Fdh_rsa.unblind_sig pub ~bks bsig in
+  let res = Fdh_rsa.verify ~key:pub sig_ ~msg in
   assert (Result.is_ok res);
 
   ()