From e0e8354551b69870bc8cadd97d8b2727ede6bd7e Mon Sep 17 00:00:00 2001 From: swrup Date: Mon, 23 Feb 2026 05:20:24 +0100 Subject: [PATCH] --- src/config.ml | 17 ------------- src/keys.ml | 26 ++++++++++---------- src/secmod_eddsa.ml | 8 ------- src/secmod_rsa.ml | 58 +++++++++++++++++++++++++++++++++++---------- 4 files changed, 59 insertions(+), 50 deletions(-) diff --git a/src/config.ml b/src/config.ml index b4aebab2..6b44aa65 100644 --- a/src/config.ml +++ b/src/config.ml @@ -188,25 +188,8 @@ module Exchange_secmod_rsa = struct let lookahead_sign = get "lookahead_sign" |> duration let overlap_duration = get "overlap_duration" |> duration - let duration = get "duration" |> duration let key_dir = get "key_dir" let sm_priv_key = get "sm_priv_key" - - (* only support one rsa_keysize *) - let rsa_keysize = - Coin.all_coins - |> List.map (fun coin -> coin.Coin.rsa_keysize) - |> List.sort_uniq Int.compare - |> function - | [] -> fail "no coin section found" - | a :: b :: _ -> - fail - "coins with different rsa_keysize are not supported, found \ - rsa_keysize = %d and %d" - a b - | n :: [] -> n - - let sections = Coin.all_coins |> List.map (fun coin -> coin.Coin.section_name) end module Exchange_secmod_eddsa = struct diff --git a/src/keys.ml b/src/keys.ml index 69721fec..e3e93913 100644 --- a/src/keys.ml +++ b/src/keys.ml @@ -62,11 +62,13 @@ module Make (Conn : Pg.CONN) : S = struct let denominations () = Pg.get_denominations conn () |> unwrap_err_caqti - (* TODO check stamps definitions *) let make_future_sk ~pub ~start ~expire = let stamp_start = Timestamp.of_absolute start in let stamp_expire = Timestamp.of_absolute expire in - let stamp_end = stamp_expire in + let stamp_end = + Timestamp.of_absolute + @@ Time.Absolute.add start Config.Exchange.signkey_legal_duration + in let signkey_secmod_sig = let open Signatures.SigningKeyAnnouncement in let exchange_pub = pub in @@ -113,14 +115,13 @@ module Make (Conn : Pg.CONN) : S = struct let h_pub = DenominationHash.hash (RsaPublicKey.to_octets pub) in let denom_secmod_sig = let open Signatures.DenominationKeyAnnouncement in - let h_denom_pub = h_pub in - let h_section_name = Hash.Cstring.H64.hash section_name in - let anchor_time = stamp_start in - let duration_withdraw = - Timestamp.diff stamp_start stamp_expire_withdraw - in signf Sm_rsa.sign_secmod - { h_denom_pub; h_section_name; anchor_time; duration_withdraw } + { + h_denom_pub= h_pub; + h_section_name= Hash.Cstring.H64.hash section_name; + anchor_time= stamp_start; + duration_withdraw= Timestamp.diff stamp_start stamp_expire_withdraw; + } in FutureDenom. { @@ -162,9 +163,8 @@ module Make (Conn : Pg.CONN) : S = struct let future_denominations () = let+ l = list_map - (fun (section_name, pub, t1, _t2) -> + (fun (section_name, pub, t1) -> let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in - (*?? let duration_withdraw = Time.Absolute.diff t1 t2 in*) let* opt = find_denomination h_pub in match opt with | None -> @@ -278,12 +278,12 @@ module Make (Conn : Pg.CONN) : S = struct let certify_future_denomination h_pub master_sig = Sm_rsa.keys () - |> List.find_opt (fun (_section_name, pub, _t1, _t2) -> + |> List.find_opt (fun (_section_name, pub, _t1) -> let h_pub' = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in h_pub' = h_pub) |> function | None -> Error "future denomination not found" - | Some (section_name, pub, t1, _t2) -> + | Some (section_name, pub, t1) -> let h_pub = Hash.DenominationHash.hash (RsaPublicKey.to_octets pub) in let* () = let* opt = find_denomination h_pub in diff --git a/src/secmod_eddsa.ml b/src/secmod_eddsa.ml index f83ca224..8608533e 100644 --- a/src/secmod_eddsa.ml +++ b/src/secmod_eddsa.ml @@ -234,12 +234,4 @@ end - sign: check timestamps before signing - schedule tasks - !lock - - taler doc/config is confusing - how is computed stamp_expire stamp_end - what to do of 'Exchange.signkey_legal_duration' - => - stamp_expire = stamp_start + duration - stamp_end = stamp_start + signkey_legal_duration - (not sure about it) *) diff --git a/src/secmod_rsa.ml b/src/secmod_rsa.ml index 50aa954f..13d75c9c 100644 --- a/src/secmod_rsa.ml +++ b/src/secmod_rsa.ml @@ -1,4 +1,6 @@ -(* TODO refacto common parts with secmod_eddsa *) +(* TODO + refacto common parts with secmod_eddsa + use DenominationHash.t instead of rsa_pub? *) let src = Logs.Src.create "mte.secmod_rsa" module Log = (val Logs.src_log src : Logs.LOG) @@ -7,7 +9,37 @@ module Log = (val Logs.src_log src : Logs.LOG) open Syntax open Crypto open Time -module Cfg = Config.Exchange_secmod_rsa + +module Cfg = struct + open Config + include Exchange_secmod_rsa + + let sections = Coin.all_coins |> List.map (fun coin -> coin.Coin.section_name) + + (* helper functions to get config value from section_name: *) + + let duration_withdraw = + let duration_withdraw_assoc = + Coin.all_coins + |> List.map (fun coin -> (coin.Coin.section_name, coin.duration_withdraw)) + in + fun ~section_name -> + match List.assoc_opt section_name duration_withdraw_assoc with + | None -> + Fmt.failwith "section_name `%s` not found in config" section_name + | Some v -> v + + let rsa_keysize = + let rsa_keysize_assoc = + Coin.all_coins + |> List.map (fun coin -> (coin.Coin.section_name, coin.rsa_keysize)) + in + fun ~section_name -> + match List.assoc_opt section_name rsa_keysize_assoc with + | None -> + Fmt.failwith "section_name `%s` not found in config" section_name + | Some v -> v +end type key = { section_name: string; @@ -92,8 +124,9 @@ let get_key_dir_contents dir_fpath = (* -- *) -let gen_key section_name t1 t2 = - let priv, pub = RsaPrivateKey.generate ~bits:Cfg.rsa_keysize () in +let gen_key ~section_name t1 t2 = + let bits = Cfg.rsa_keysize ~section_name in + let priv, pub = RsaPrivateKey.generate ~bits () in Log.debug (fun m -> m "generated key (%s-%s):@,`%s`" (time_abs_to_string t1) (time_abs_to_string t2) (RsaPublicKey.to_b32 pub)); @@ -101,16 +134,16 @@ let gen_key section_name t1 t2 = let sort_keys l = List.sort (fun a b -> Absolute.compare a.t2 b.t2) l -let split_in_periodes ~start ~end_ = +let split_in_periodes ~start ~end_ ~duration_withdraw = assert (start < end_); (* no overlap on first periode *) let t1 = start in - let t2 = Absolute.add start Cfg.duration in + let t2 = Absolute.add start duration_withdraw in let acc = [ (t1, t2) ] in let start = t2 in let rec go acc start end_ = let t1 = Absolute.sub start Cfg.overlap_duration in - let t2 = Absolute.add start Cfg.duration in + let t2 = Absolute.add start duration_withdraw in if t2 > end_ then acc else go ((t1, t2) :: acc) t2 end_ in go acc start end_ @@ -126,9 +159,10 @@ let gen_additional_keys_until_lookahead ~now ~section_name l = let end_ = Absolute.add now Cfg.lookahead_sign in if Absolute.compare start end_ >= 0 then [] else - let periodes = split_in_periodes ~start ~end_ in + let duration_withdraw = Cfg.duration_withdraw ~section_name in + let periodes = split_in_periodes ~start ~end_ ~duration_withdraw in let new_keys = - List.map (fun (t1, t2) -> gen_key section_name t1 t2) periodes + List.map (fun (t1, t2) -> gen_key ~section_name t1 t2) periodes in new_keys @@ -227,7 +261,7 @@ module Make () = struct |> list_iter delete let add section_name t1 t2 = - let k = gen_key section_name t1 t2 in + let k = gen_key ~section_name t1 t2 in Hashtbl.replace t.ht k.pub k; () @@ -236,8 +270,8 @@ module Make () = struct let keys () = Hashtbl.to_seq_values t.ht |> List.of_seq - |> List.map (fun { section_name; priv= _; pub; t1; t2 } -> - (section_name, pub, t1, t2)) + |> List.map (fun { section_name; priv= _; pub; t1; t2= _ } -> + (section_name, pub, t1)) let sign_secmod s = EddsaSignature.sign ~key:t.sm_key_priv s