add verify_signature.ml

src/http_management.ml

@@ -16,68 +16,26 @@ module Keys_get = struct
 end
 
 module Keys_post = struct
-  let verify_fdn (module Keys : Keys.S)
+  let verify (module Keys : Keys.S)
-      DenomSignature.{ h_denom_pub; master_sig } =
+      MasterSignatures.{ denom_sigs; signkey_sigs } =
-    let open FutureDenom in
+    let* () = list_iter Keys.verify_future_signkey signkey_sigs in
-    let open Signatures.DenominationKeyValidity in
+    let* () = list_iter Keys.verify_future_denomination denom_sigs in
-    let* fdn = Keys.find_future_denomination h_denom_pub in
-    verify Config.master_public_key master_sig
-      {
-        R.master= Config.master_public_key;
-        start= fdn.stamp_start;
-        expire_withdraw= fdn.stamp_expire_withdraw;
-        expire_spend= fdn.stamp_expire_deposit;
-        expire_legal= fdn.stamp_expire_legal;
-        value= fdn.value;
-        fee_withdraw= fdn.fee_withdraw;
-        fee_deposit= fdn.fee_deposit;
-        fee_refresh= fdn.fee_refresh;
-        fee_refund= fdn.fee_refund;
-        denom_hash= h_denom_pub;
-      }
-
-  let verify_fsk (module Keys : Keys.S) SignKeySignature.{ key; master_sig } =
-    let open Signatures.ExchangeSigningKeyValidity in
-    let* fsk = Keys.find_future_signkey key in
-    verify Config.master_public_key master_sig
-      {
-        R.start= fsk.stamp_start;
-        expire= fsk.stamp_expire;
-        end_= fsk.stamp_end;
-        signkey_pub= key;
-      }
-
-  let verify keys MasterSignatures.{ denom_sigs; signkey_sigs } =
-    let* () = list_iter (verify_fsk keys) signkey_sigs in
-    let* () = list_iter (verify_fdn keys) denom_sigs in
     Ok ()
 
-  let do_ ~db_conn:_ (module Keys : Keys.S)
+  let do_ (module Keys : Keys.S) MasterSignatures.{ denom_sigs; signkey_sigs } =
-      MasterSignatures.{ denom_sigs; signkey_sigs } =
+    let* () = list_iter Keys.certify_future_signkey signkey_sigs in
-    let* () =
+    let* () = list_iter Keys.certify_future_denomination denom_sigs in
-      list_iter
-        (fun SignKeySignature.{ key; master_sig } ->
-          Keys.certify_future_signkey key master_sig)
-        signkey_sigs
-    in
-    let* () =
-      list_iter
-        (fun DenomSignature.{ h_denom_pub; master_sig } ->
-          Keys.certify_future_denomination h_denom_pub master_sig)
-        denom_sigs
-    in
     Ok ()
 
   let jsont = MasterSignatures.jsont
 
   let f req server _env =
     Logs.info (fun m -> m "POST /management/keys/");
-    let db_conn = Vif.Server.device Devices.db_connection server in
     let keys = Vif.Server.device Devices.keys server in
     let res =
       let* v = Vif.Request.of_json req |> unwrap_err_msg in
       let* () = verify keys v in
-      let* () = do_ ~db_conn keys v in
+      let* () = do_ keys v in
       Ok ()
     in
     Respond.result_no_content res req

src/keys.ml

@@ -11,15 +11,11 @@ module type S = sig
   val find_denomination : denom_hash -> Denomination.t option result
   val signkeys : unit -> Signkey.t list result
   val denominations : unit -> Denomination.t list result
-  val find_future_signkey : eddsa_pub -> Api.FutureSignKey.t result
-  val find_future_denomination : denom_hash -> Api.FutureDenom.t result
   val make_future_keys_response : unit -> Api.FutureKeysResponse.t result
-
+  val verify_future_signkey : Api.SignKeySignature.t -> unit result
-  val certify_future_signkey :
+  val verify_future_denomination : Api.DenomSignature.t -> unit result
-    eddsa_pub -> Signatures.ExchangeSigningKeyValidity.t -> unit result
+  val certify_future_signkey : Api.SignKeySignature.t -> unit result
-
+  val certify_future_denomination : Api.DenomSignature.t -> unit result
-  val certify_future_denomination :
-    denom_hash -> Signatures.DenominationKeyValidity.t -> unit result
 
   val revoke_signkey :
     eddsa_pub -> Signatures.MasterSigningKeyRevocation.t -> unit result
@@ -277,7 +273,24 @@ module Make (Conn : Pg.CONN) : S = struct
         master_sig;
       }
 
-  let certify_future_signkey pub master_sig =
+  let verify_future_signkey Api.SignKeySignature.{ key; master_sig } =
+    let open Signatures.ExchangeSigningKeyValidity in
+    let* fsk = find_future_signkey key in
+    verify Config.master_public_key master_sig
+      {
+        R.start= fsk.stamp_start;
+        expire= fsk.stamp_expire;
+        end_= fsk.stamp_end;
+        signkey_pub= key;
+      }
+
+  let verify_future_denomination Api.DenomSignature.{ h_denom_pub; master_sig }
+      =
+    let* fdn = find_future_denomination h_denom_pub in
+    let dn = dn_of_future_dn fdn h_denom_pub master_sig in
+    Verify_signature.denomination_key_validity ~key:Config.master_public_key dn
+
+  let certify_future_signkey Api.SignKeySignature.{ key= pub; master_sig } =
     match Sm_eddsa.find_key pub with
     | None -> Error "future signkey not found"
     | Some (pub, (t1, t2)) -> (
@@ -295,7 +308,8 @@ module Make (Conn : Pg.CONN) : S = struct
                 m "certified signkey `%s`" (EddsaPublicKey.to_b32 sk.pub));
             ())
 
-  let certify_future_denomination h_pub master_sig =
+  let certify_future_denomination
+      Api.DenomSignature.{ h_denom_pub= h_pub; master_sig } =
     match Sm_rsa.find_key h_pub with
     | None -> Error "future denomination not found"
     | Some (h_pub, (section_name, pub, t1)) -> (

src/verify_signature.ml

@@ -0,0 +1,17 @@
+let denomination_key_validity ~key dn =
+  let open Denomination in
+  let open Signatures.DenominationKeyValidity in
+  verify key dn.master_sig
+    {
+      R.master= key;
+      start= dn.stamp_start;
+      expire_withdraw= dn.stamp_expire_withdraw;
+      expire_spend= dn.stamp_expire_deposit;
+      expire_legal= dn.stamp_expire_legal;
+      value= dn.value;
+      fee_withdraw= dn.fee_withdraw;
+      fee_deposit= dn.fee_deposit;
+      fee_refresh= dn.fee_refresh;
+      fee_refund= dn.fee_refund;
+      denom_hash= dn.h_pub;
+    }

test/validate_response.ml

@@ -75,24 +75,9 @@ let keys content =
 
   let denom_l = v.denominations |> Denomination.denoms_of_denomgroups in
   let* () =
-    let open Denomination in
     denom_l
     |> list_iter (fun dn ->
-        let open Signatures.DenominationKeyValidity in
+        Verify_signature.denomination_key_validity ~key:v.master_public_key dn)
-        verify v.master_public_key dn.master_sig
-          {
-            R.master= v.master_public_key;
-            start= dn.stamp_start;
-            expire_withdraw= dn.stamp_expire_withdraw;
-            expire_spend= dn.stamp_expire_deposit;
-            expire_legal= dn.stamp_expire_legal;
-            value= dn.value;
-            fee_withdraw= dn.fee_withdraw;
-            fee_deposit= dn.fee_deposit;
-            fee_refresh= dn.fee_refresh;
-            fee_refund= dn.fee_refund;
-            denom_hash= dn.h_pub;
-          })
   in
   let* () =
     let last_issue_date =