From c792c2af28f5c1a7afb3eefe542729ca5757b0bd Mon Sep 17 00:00:00 2001 From: swrup Date: Sat, 24 Jan 2026 06:12:52 +0100 Subject: [PATCH] --- data/secmod/kudo_1 | Bin 0 -> 1176 bytes data/secmod/kudo_2 | Bin 0 -> 1176 bytes data/secmod/sk_0 | 1 + data/secmod/sm_key | 1 + src/secmod.ml | 64 +++++++++++++++++++++++++++------------------ 5 files changed, 40 insertions(+), 26 deletions(-) create mode 100644 data/secmod/kudo_1 create mode 100644 data/secmod/kudo_2 create mode 100644 data/secmod/sk_0 create mode 100644 data/secmod/sm_key diff --git a/data/secmod/kudo_1 b/data/secmod/kudo_1 new file mode 100644 index 0000000000000000000000000000000000000000..93bc8f856799489e594b641474c795941bb832d6 GIT binary patch literal 1176 zcmZSJU}RuqU}%6t1_lNOMh3>BU$!Bko<&ZN_*!RuRJ$5==p)a!9tGBUj%g}-I<18P zTcW?J=>C?s{m!6uUum`y|JBm(303A>wrp6ro^c7gMTWrMSMTpOsN6YHX5+V2Wr@NK zrCk1>Q(g+MvgG<|a8aJkMAGrNTq<`#t-!&$W#3nv_cJ!PDNEcf@NUW$Mz;&6r``^m z7+A52xzuiHaNgy$7uCY{Pby03dRoAkbcNlx^l;uy=~met*RK8wy=`4w%~z2sy;eHS z&^*qw{{N=<#je+Wh=hpUpW@BE>8kh5cl;8P{2dQVrkRI^Sn4h)`zsN+tVrl` z)n1ctEzB{^eJ+bFE}G2y9b8(w#-USzlZ|E~3{i zzeShJ^7qNxp|XFMI4RyxygT#o8Lls!mD-0Sn(SWq`##K3WUFs)lVCQu=EeM*|KV!k zMj@}i@gJUhFbZ`B1|Ml?x3_vPv-TQG?v2tEVw@Wy6Ngy&$Q)IyBrSM-{jpby!a<;%?YdE<{w)1@~MH|?uT#I76#DP4>T6<~BWgZfYxD6&Db814cAY$aG|;|Varv_kzWTEpFJvxQ zZn^YJsgv``fGy9>&ugyvlb(~CbvjilP;fr;Ort}KR`Z&vk`C;Rz-3N3x9ak}uFS61_V z!)r5@{GYu1c3tneZi&}kf0wm4ed?~IH$8F>ueA0k>$jf&UDDs#xkIasQK0S0ITx4j z5~4A8?i>rf_T--41)W qKc{`rBIIS>`x8-nLe3ms^fk^_J<9w=^~RQLGW0^#qO5AQVw zl}fF?EO&Bl)N!Ya)ppa17P)B!US4ubc#_?=#Dy7YuO1(IB^~xB?xM<5i;pYg%jF{y zJEV&_K1VIL<+xdux1iN-;VFateXe&558ZixY2&%NeQxy{VXNQkxt#bmV?ocQqe`3q zR`WRQpZ7<>_laPv;M7B26Q1;(*AFP}ktja=y|FXpRj}Jk@uCBt6!><$bvogu@R9Z8 z#Gbvgm!I|Vy18v(u9{V(tV5zifK8`ceEyDSC(nz89p5v5W=`JT+%pWO4hDbq5173D zS{@eGxm@A#uOO?9vsp4DmYMjzcp-3JfNh?Jh*Xxl-LcLH%dX;}_K4*{>$d&#o%ZYE zQqiMQ&#p5RUv=?eyX+{j>ELx4+g_{GpOy>P|Il9l-*NrJ0{+8qB_>RWH7Qeivr6l6 z$Dwamc0J$x^%=ud`%l^4Z~iH}gv(n^yC|RVGEw20`za~U(5CnaH{`Q6rA9UTv^y<3 zSf5$JHf@{j=I?3e7}Eb6JGyMxw_?KC8GC%^A9vsGb+6?|V1QTW`JJgg)k{9db$)sM z-1^{66Rl5YA5D_G`mEO=ZM$Ss`py?0-YcKvdUf3^_q%iFgFDXdA1cLS+ZOA65m%YC z<(0%h zPR}jk;;|mH#dd|8XLd_h&Aa*bK;^w{Ifs0TS|5w?sV&iEVEMq1!&Lvl#Ah4lkBLmW z?XTa~x)%1U&N9ANck4l`n~CV1(zLu;bLM=odQt0nWOlx?(^JlnprunyLSlj*DtsyQ z?p6+1w$#svujbYY(`1<=>VXFi_3Ut7qN5{r#`k#6vj-neKRh(`={C=A(-Zuj^s4Os z$j0$Naq@2OTRVE>ABn9togphfUyDZ}vZV3xpEt}KTr6b1PxUx4bH=W@lSzIn9CR9|l>ev*{ml@UH_P$!c_NH=CPt&2Mr$*cP_XHlL~2{J^U;S%?SJO5-=3(ttMK_-o?peA zr5p44KQsw2rG}SfJegRnz^MFP?}8zphYVZh$AqFkvFYxziGPxJ<#bOkW&dGgePf0H ziSN=MJp#=ncb5ldC_Xq=m|yZ->rl>&_kSLmJ(ja7N>(k)Dg^FC|QWj{GrJa0Q`*0Lv6ugQh0^0dY*)t8WP)%U${A;IYU&6z!_0Bf@-Hbcy-GeP79ll$!K6?G3EG|h#;X=k2=i8qBaqg>i zXGdIidinU3hh1ckIA>m)O^n2yO%uItp4f4$NPE%qm;jTgvsVt@3!Hmi=d|{NHPua9 qLX?~hqI%-aw$@bnn*LIqXs-8n7BByqZ?ejf_nQB)nNBb?D+B=4twihq literal 0 HcmV?d00001 diff --git a/data/secmod/sk_0 b/data/secmod/sk_0 new file mode 100644 index 00000000..127d374e --- /dev/null +++ b/data/secmod/sk_0 @@ -0,0 +1 @@ +pxR Br캾> \ No newline at end of file diff --git a/data/secmod/sm_key b/data/secmod/sm_key new file mode 100644 index 00000000..f717f36c --- /dev/null +++ b/data/secmod/sm_key @@ -0,0 +1 @@ +OqпoA}]Y.? \ No newline at end of file diff --git a/src/secmod.ml b/src/secmod.ml index d56a1c98..4e8373a6 100644 --- a/src/secmod.ml +++ b/src/secmod.ml @@ -70,7 +70,7 @@ module Make (Conn : Pg.CONN) = struct dn_section_name_ht: (denomination_hash, string) Hashtbl.t; } - let dir = Fpath.(v "data" / "secmod ") + let dir = Fpath.(v "data" / "secmod") let db_lookup_signkey_data conn fname priv = let pub = EddsaPrivateKey.pub_of_priv priv in @@ -110,7 +110,7 @@ module Make (Conn : Pg.CONN) = struct in let* sm_key_priv = Data_file.read_eddsa Fpath.(dir / "sm_key") in let* signkeys = - let l = List.init 1 (fun i -> Fpath.(dir / string_of_int i)) in + let l = List.init 1 (fun i -> Fpath.(dir / Fmt.str "sk_%d" i)) in let* l = list_map (fun fname -> load_signkey conn fname) l in match opt_list l with Error () -> error_invalid_state | Ok opt -> Ok opt in @@ -249,18 +249,49 @@ module Make (Conn : Pg.CONN) = struct in { lock; sm_key_priv; sm_key_pub; sk_ht; dn_ht; dn_section_name_ht } + let store t = + Miou.Mutex.protect t.lock @@ fun () -> + let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in + let* () = + Hashtbl.to_seq_values t.sk_ht + |> List.of_seq + |> List.mapi (fun i (key : signkey) -> + let fname = Fpath.(dir / Fmt.str "sk_%d" i) in + (fname, key.priv)) + |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key) + in + let* () = + Hashtbl.to_seq_values t.dn_ht + |> List.of_seq + |> List.map (fun (key : denom) -> + let section_name = + match Hashtbl.find_opt t.dn_section_name_ht key.dn_data.h_pub with + | None -> + Fmt.failwith + "secmod failure: invalid state, section_name not found" + | Some s -> s + in + let fname = Fpath.(dir / section_name) in + (fname, key.priv)) + |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key) + in + Ok () + let t = match load (module Conn) with | Ok None -> let t = make_new () in + let () = + match store t with + | Error (`Msg e) -> Fmt.failwith "secmod storage failure: %s." e + | Ok () -> () + in Logs.info (fun m -> m "secmod initialized with fresh keys"); t - | Ok (Some v) -> + | Ok (Some t) -> Logs.info (fun m -> m "secmod initialized from storage"); - v - | Error _ -> - (* TODO error: pretty print *) - Fmt.failwith "secmod init failure." + t + | Error _ -> Fmt.failwith "secmod init failure." (* note: don't expose a signing function if we want a real "security module" one day *) let sign_with_sm_key s = EddsaSignature.sign ~key:t.sm_key_priv s @@ -369,23 +400,4 @@ module Make (Conn : Pg.CONN) = struct let denom = { denom with dn_data } in Hashtbl.replace t.dn_ht h_denom_pub denom; Ok () - - (* TODO *) - let _store t = - let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key_priv in - let* () = - get_signkeys () - |> List.mapi (fun i (key : signkey) -> - let fname = Fpath.(dir / string_of_int i) in - (fname, key.priv)) - |> list_iter (fun (fname, key) -> Data_file.write_eddsa fname key) - in - let* () = - get_denoms () - |> List.mapi (fun i (key : denom) -> - let fname = Fpath.(dir / string_of_int i) in - (fname, key.priv)) - |> list_iter (fun (fname, key) -> Data_file.write_rsa fname key) - in - Ok () end