From e59fff716b2c6d89b0e48f34f90e2484bbd197bc Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 13 Feb 2026 09:34:03 +0100
Subject: [PATCH] JJ: Description from the destination commit: add kdf

JJ: Description from source commit:
.
---
 dune-project   |  1 +
 mte.opam       |  1 +
 src/dune       |  1 +
 src/fdh.ml     | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/rsa.ml     |  0
 test/crypto.ml | 21 +++++++++++++++++++
 6 files changed, 79 insertions(+)
 create mode 100644 src/fdh.ml
 create mode 100644 src/rsa.ml

diff --git a/dune-project b/dune-project
index 1aadd32c..d4fc79ff 100644
--- a/dune-project
+++ b/dune-project
@@ -35,6 +35,7 @@
    bin
    angstrom
    mirage-crypto
+   kdf
    digestif
    duration
    jsont
diff --git a/mte.opam b/mte.opam
index 53820528..3d706521 100644
--- a/mte.opam
+++ b/mte.opam
@@ -22,6 +22,7 @@ depends: [
   "bin"
   "angstrom"
   "mirage-crypto"
+  "kdf"
   "digestif"
   "duration"
   "jsont"
diff --git a/src/dune b/src/dune
index a9322eed..0a6fa0ea 100644
--- a/src/dune
+++ b/src/dune
@@ -17,6 +17,7 @@
   caqti-driver-pgx
   bin
   mirage-crypto
+  kdf.hkdf
   digestif
   duration
   vif
diff --git a/src/fdh.ml b/src/fdh.ml
new file mode 100644
index 00000000..31f4c893
--- /dev/null
+++ b/src/fdh.ml
@@ -0,0 +1,55 @@
+module Kdf = struct
+  module XTR = Hkdf.Make (Digestif.SHA512)
+  module PRF = Hkdf.Make (Digestif.SHA256)
+
+  let kdf ~xts ~ikm ~ctx ~len =
+    let prk = XTR.extract ~salt:xts ikm in
+    let okm = PRF.expand ~prk ~info:ctx len in
+    okm
+end
+
+(* WIP
+let kdf_mod_n ~n ~xts ~ikm ~ctx =
+  let nbits = Z.numbits n in
+  let rec go ctr =
+    let len = ((nbits - 1) / 8) + 1 in
+    let ctr_be =
+      let b = Bytes.create 2 in
+      Bytes.set_uint16_be b 0 ctr;
+      Bytes.unsafe_to_string b
+    in
+    let ctx = String.cat ctx ctr_be in
+    let okm = Kdf.kdf ~xts ~ikm ~ctx ~len in
+    let r = Z.of_bits okm in
+    (* we do that because n is odd?
+       TODO
+       gcry_mpi_clear_highbit .. *)
+    if Z.gt r n then go (succ ctr) else r
+  in
+  go 0
+
+let rsa_full_domain_hash pub msg =
+  let xts = RsaPublicKey.to_octets pub in
+  let ctx = "RSA-FDA FTpsW!" in
+  let r = kdf_mod_n ~n:pub.n ~xts ~ikm:msg ~ctx in
+  r
+
+let rsa_sign_fdh priv msg =
+  let pub = Mirage_crypto_pk.Rsa.pub_of_priv priv in
+  let v = rsa_full_domain_hash pub msg in
+  let v = Z.to_bits v in
+  Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~crt_hardening:true ~key:priv v
+
+let rsa_blinding_key_derive (pub : RsaPublicKey.t) bks =
+  let xts = "Blinding KDF extractor HMAC key" in
+  let ctx = "Blinding KDF" in
+  let r = kdf_mod_n ~n:pub.n ~xts ~ikm:bks ~ctx in
+  r
+
+let rsa_blind pub ~bks ~msg =
+  let data = rsa_full_domain_hash pub msg in
+  let bkey = rsa_blinding_key_derive pub bks in
+  let r_e = Z.powm bkey pub.e pub.n in
+  let data_r_e = Z.rem (Z.mul data r_e) pub.n in
+  Z.to_bits data_r_e
+  *)
diff --git a/src/rsa.ml b/src/rsa.ml
new file mode 100644
index 00000000..e69de29b
diff --git a/test/crypto.ml b/test/crypto.ml
index 9b7578e7..0d09e8a8 100644
--- a/test/crypto.ml
+++ b/test/crypto.ml
@@ -73,3 +73,24 @@ let () =
   in
 
   ()
+
+let () =
+  (* kdf *)
+  let salt = "94KPT83PCNS7J83KC5P78Y8" in
+  let ikm = "94KPT83MD1JJ0WV5CDS6AX10D5Q70XBM41NPAY90DNGQ8SBJD5GPR" in
+  let ctx =
+    "94KPT83141HPYVKMCNW78833D1TPWTSC41GPRWVF41NPWVVQDRG62WS04XMPWSKF4WG6JVH0EHM6A82J8S1G"
+  in
+  let out_len = 64 in
+  let out =
+    "GTMR4QT05Z9WF5HKVG0WK9RPXGHSMHJNW377G9GJXCA8B0FEKPF4D27RJMSJZYWSQNTBJ5EYVV7ZW18B48Z0JVJJ80RHB706Y96Q358"
+  in
+
+  let xts = salt |> decode in
+  let ikm = ikm |> decode in
+  let ctx = ctx |> decode in
+  let okm = Fdh.Kdf.kdf ~xts ~ikm ~ctx ~len:out_len in
+  let okm = okm |> encode in
+  assert (okm = out);
+
+  ()