swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

+.

Browse source
This commit is contained in:
swrup 2026-02-17 13:01:09 +01:00
parent 79920eeff5
commit df181b590d
2 changed files with 43 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

75
src/secmod.ml
View file

@ -15,7 +15,7 @@ module type S = sig
val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_signkeys : unit -> Api.FutureSignKey.t list
val get_future_denominations : unit -> Api.FutureDenom.t list val get_future_denominations : unit -> Api.FutureDenom.t list
val find_signkey : eddsa_pub -> Signkey.t option val find_signkey : eddsa_pub -> Signkey.t option
val find_denomination : rsa_pub -> Denomination.t option val find_denomination : denom_hash -> Denomination.t option
val certify_future_signkey : val certify_future_signkey :
eddsa_pub -> eddsa_pub ->
@ -23,7 +23,7 @@ module type S = sig
(unit, string) result (unit, string) result
val certify_future_denomination : val certify_future_denomination :
rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result
val revoke_signkey : val revoke_signkey :
eddsa_pub -> eddsa_pub ->
@ -31,7 +31,7 @@ module type S = sig
(unit, string) result (unit, string) result
val revoke_denomination : val revoke_denomination :
rsa_pub -> denom_hash ->
Signatures.MasterDenominationKeyRevocation.t -> Signatures.MasterDenominationKeyRevocation.t ->
(unit, string) result (unit, string) result
@ -41,6 +41,7 @@ end
module Make (Conn : Pg.CONN) = struct module Make (Conn : Pg.CONN) = struct
open Syntax open Syntax
open Crypto open Crypto
module DenominationHash = Hash.DenominationHash
type sk = Signkey.t type sk = Signkey.t
type future_sk = Api.FutureSignKey.t type future_sk = Api.FutureSignKey.t
@ -52,14 +53,14 @@ module Make (Conn : Pg.CONN) = struct
sm_key: eddsa_priv; sm_key: eddsa_priv;
sm_pubkey: eddsa_pub; sm_pubkey: eddsa_pub;
sk_ht: (eddsa_pub, sk) Hashtbl.t; sk_ht: (eddsa_pub, sk) Hashtbl.t;
dn_ht: (rsa_pub, dn) Hashtbl.t; dn_ht: (denom_hash, dn) Hashtbl.t;
sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t;
dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t;
future_sk_ht: (eddsa_pub, future_sk) Hashtbl.t; future_sk_ht: (eddsa_pub, future_sk) Hashtbl.t;
future_dn_ht: (rsa_pub, future_dn) Hashtbl.t; future_dn_ht: (denom_hash, future_dn) Hashtbl.t;
future_sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t; future_sk_key_ht: (eddsa_pub, eddsa_priv) Hashtbl.t;
future_dn_key_ht: (rsa_pub, rsa_priv) Hashtbl.t; future_dn_key_ht: (denom_hash, rsa_priv) Hashtbl.t;
dn_section_name_ht: (rsa_pub, string) Hashtbl.t; dn_section_name_ht: (denom_hash, string) Hashtbl.t;
} }
let database_find_sk conn fname pub = let database_find_sk conn fname pub =
@ -72,8 +73,7 @@ module Make (Conn : Pg.CONN) = struct
(Fpath.to_string fname) (Fpath.to_string fname)
| Some sk_data -> Ok sk_data | Some sk_data -> Ok sk_data
let database_find_dn conn ~section_name pub = let database_find_dn conn ~section_name h_pub =
let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in
let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
match opt with match opt with
| None -> | None ->
@ -139,9 +139,14 @@ module Make (Conn : Pg.CONN) = struct
let* l = let* l =
list_map list_map
(fun (section_name, priv) -> (fun (section_name, priv) ->
let pub = RsaPrivateKey.pub_of_priv priv in let h_pub =
let+ dn = database_find_dn conn ~section_name pub in priv
((pub, dn), (pub, priv))) |> RsaPrivateKey.pub_of_priv
|> RsaPublicKey.to_octets
|> DenominationHash.hash
in
let+ dn = database_find_dn conn ~section_name h_pub in
((h_pub, dn), (h_pub, priv)))
dn_keys dn_keys
in in
let dn_ht, dn_key_ht = let dn_ht, dn_key_ht =
@ -229,11 +234,10 @@ module Make (Conn : Pg.CONN) = struct
RsaDenominationKey.{ age_mask= 0; rsa_pub= pub } RsaDenominationKey.{ age_mask= 0; rsa_pub= pub }
in in
let denom_pub = DenominationKey.Rsa rsa_denomination_key in let denom_pub = DenominationKey.Rsa rsa_denomination_key in
let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in
let denom_secmod_sig = let denom_secmod_sig =
let open Signatures.DenominationKeyAnnouncement in let open Signatures.DenominationKeyAnnouncement in
let h_denom_pub = let h_denom_pub = h_pub in
Hash.DenominationHash.hash (RsaPublicKey.to_octets pub)
in
let h_section_name = Hash.Cstring.H64.hash section_name in let h_section_name = Hash.Cstring.H64.hash section_name in
let anchor_time = stamp_start in let anchor_time = stamp_start in
let duration_withdraw = let duration_withdraw =
@ -259,8 +263,8 @@ module Make (Conn : Pg.CONN) = struct
denom_secmod_sig; denom_secmod_sig;
} }
in in
Hashtbl.replace t.future_dn_ht pub future_dn; Hashtbl.replace t.future_dn_ht h_pub future_dn;
Hashtbl.replace t.future_dn_key_ht pub priv; Hashtbl.replace t.future_dn_key_ht h_pub priv;
() ()
let make_new () = let make_new () =
@ -297,13 +301,14 @@ module Make (Conn : Pg.CONN) = struct
let sm_pubkey = t.sm_pubkey let sm_pubkey = t.sm_pubkey
let sign_with_sm_key s = sign_with_sm_key t s let sign_with_sm_key s = sign_with_sm_key t s
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
let sign_with_signkey ~pub s = let sign_with_signkey ~pub s =
match Hashtbl.find_opt t.sk_key_ht pub with match Hashtbl.find_opt t.sk_key_ht pub with
| None -> Fmt.failwith "secmod failure: signkey not found." | None -> Fmt.failwith "secmod failure: signkey not found."
| Some priv -> EddsaSignature.sign ~key:priv s | Some priv -> EddsaSignature.sign ~key:priv s
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
let verify_with_master_key = let verify_with_master_key =
EddsaSignature.verify ~key:Config.master_public_key EddsaSignature.verify ~key:Config.master_public_key
@ -365,14 +370,15 @@ module Make (Conn : Pg.CONN) = struct
let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in let* () = Pg.insert_signkey (module Conn) sk |> unwrap_err_caqti in
Ok ()) Ok ())
let certify_future_denomination pub master_sig = let certify_future_denomination h_pub master_sig =
match match
( Hashtbl.find_opt t.future_dn_ht pub, ( Hashtbl.find_opt t.future_dn_ht h_pub,
Hashtbl.find_opt t.future_dn_key_ht pub ) Hashtbl.find_opt t.future_dn_key_ht h_pub )
with with
| None, _ | _, None -> Error "secmod failure: future signkey not found." | None, _ | _, None ->
Error "secmod failure: future denomination not found."
| Some future_dn, Some priv -> ( | Some future_dn, Some priv -> (
match Hashtbl.find_opt t.dn_ht pub with match Hashtbl.find_opt t.dn_ht h_pub with
| Some _dn -> | Some _dn ->
Error Error
"secmod failure: this denomination already has a master signature" "secmod failure: this denomination already has a master signature"
@ -385,7 +391,7 @@ module Make (Conn : Pg.CONN) = struct
stamp_expire_withdraw; stamp_expire_withdraw;
stamp_expire_deposit; stamp_expire_deposit;
stamp_expire_legal; stamp_expire_legal;
denom_pub= _; denom_pub;
fee_withdraw; fee_withdraw;
fee_deposit; fee_deposit;
fee_refresh; fee_refresh;
@ -394,15 +400,14 @@ module Make (Conn : Pg.CONN) = struct
} = } =
future_dn future_dn
in in
(* TODO dn hash let rsa_pub =
need to compute it from denom_pub *) match denom_pub with
let h_pub = | Rsa Api.RsaDenominationKey.{ age_mask= _; rsa_pub } -> rsa_pub
Hash.DenominationHash.hash (RsaPublicKey.to_octets pub)
in in
let dn = let dn =
Denomination. Denomination.
{ {
pub; pub= rsa_pub;
value; value;
stamp_start; stamp_start;
stamp_expire_withdraw; stamp_expire_withdraw;
@ -418,11 +423,11 @@ module Make (Conn : Pg.CONN) = struct
revoked_sig= None; revoked_sig= None;
} }
in in
Hashtbl.replace t.dn_ht pub dn; Hashtbl.replace t.dn_ht h_pub dn;
Hashtbl.replace t.dn_key_ht pub priv; Hashtbl.replace t.dn_key_ht h_pub priv;
Hashtbl.replace t.dn_section_name_ht pub section_name; Hashtbl.replace t.dn_section_name_ht h_pub section_name;
Hashtbl.remove t.future_dn_ht pub; Hashtbl.remove t.future_dn_ht h_pub;
Hashtbl.remove t.future_dn_key_ht pub; Hashtbl.remove t.future_dn_key_ht h_pub;
let* () = Pg.insert_denom (module Conn) dn |> unwrap_err_caqti in let* () = Pg.insert_denom (module Conn) dn |> unwrap_err_caqti in
Ok ()) Ok ())

6
src/secmod.mli
View file

@ -15,7 +15,7 @@ module type S = sig
val get_future_signkeys : unit -> Api.FutureSignKey.t list val get_future_signkeys : unit -> Api.FutureSignKey.t list
val get_future_denominations : unit -> Api.FutureDenom.t list val get_future_denominations : unit -> Api.FutureDenom.t list
val find_signkey : eddsa_pub -> Signkey.t option val find_signkey : eddsa_pub -> Signkey.t option
val find_denomination : rsa_pub -> Denomination.t option val find_denomination : denom_hash -> Denomination.t option
val certify_future_signkey : val certify_future_signkey :
eddsa_pub -> eddsa_pub ->
@ -23,7 +23,7 @@ module type S = sig
(unit, string) result (unit, string) result
val certify_future_denomination : val certify_future_denomination :
rsa_pub -> Signatures.DenominationKeyValidity.t -> (unit, string) result denom_hash -> Signatures.DenominationKeyValidity.t -> (unit, string) result
val revoke_signkey : val revoke_signkey :
eddsa_pub -> eddsa_pub ->
@ -31,7 +31,7 @@ module type S = sig
(unit, string) result (unit, string) result
val revoke_denomination : val revoke_denomination :
rsa_pub -> denom_hash ->
Signatures.MasterDenominationKeyRevocation.t -> Signatures.MasterDenominationKeyRevocation.t ->
(unit, string) result (unit, string) result