From e9ee7c55e89febc125ceacfe78a0f0ed31aadc9d Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Sat, 6 Dec 2025 19:18:53 +0100
Subject: [PATCH]

---
 src/api_sig.ml        | 12 ++++++--
 tools/offline_impl.ml |  6 ++--
 tools/offline_sig.ml  | 72 +++++++++++++++++++++++++++++++++++++++++--
 3 files changed, 83 insertions(+), 7 deletions(-)

diff --git a/src/api_sig.ml b/src/api_sig.ml
index b90bc52e..b0ab5107 100644
--- a/src/api_sig.ml
+++ b/src/api_sig.ml
@@ -44,7 +44,9 @@ end) : sig
   type t
 
   val sign : key:Crypto.EddsaPrivateKey.t -> r -> t
-  val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> bool
+
+  (* Ok () on verification success *)
+  val verify : key:Crypto.EddsaPublicKey.t -> t -> r -> (unit, string) result
   val jsont : t Jsont.t
 end = struct
   open Crypto
@@ -54,7 +56,13 @@ end = struct
 
   let bin = R.bin
   let sign ~key r = EddsaSignature.sign ~key (Bin.to_string bin r)
-  let verify ~key t r = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r)
+
+  let verify ~key t r =
+    let b = EddsaSignature.verify ~key t ~msg:(Bin.to_string bin r) in
+    match b with
+    | false -> Error "signature verification failure"
+    | true -> Ok ()
+
   let jsont = EddsaSignature.jsont
 end
 
diff --git a/tools/offline_impl.ml b/tools/offline_impl.ml
index c1b16661..eb3b8364 100644
--- a/tools/offline_impl.ml
+++ b/tools/offline_impl.ml
@@ -45,10 +45,10 @@ let sign ~master_key ~input ~output =
   let* input = read_file input in
   let* master_key = read_file master_key in
   let master_key = EddsaPrivateKey.of_octets master_key in
-  let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
-  let* () = Offline_sig.verify_future_key_response future_key_response in
+  let* future_keys_response = Api.decode Api.FutureKeysResponse.jsont input in
+  let* () = Offline_sig.verify_future_keys_response future_keys_response in
   let master_signatures =
-    Offline_sig.make_master_signatures ~master_key future_key_response
+    Offline_sig.make_master_signatures ~master_key future_keys_response
   in
   let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
   let* () = write_file output s in
diff --git a/tools/offline_sig.ml b/tools/offline_sig.ml
index faba9544..c47bf3e4 100644
--- a/tools/offline_sig.ml
+++ b/tools/offline_sig.ml
@@ -77,6 +77,74 @@ let make_master_signatures ~master_key
   let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
   MasterSignatures.{ denom_sigs; signkey_sigs }
 
-let verify_future_key_response _future_key_response =
-  (* TODO *)
+(* - ** - *)
+
+[@@@ocaml.warning "-27"]
+
+let verify_future_signkey ~signkey_secmod_key
+    FutureSignKey.
+      { key; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig } =
+  let exchange_pub = key in
+  let anchor_time = stamp_start in
+  let duration =
+    Timestamp.diff stamp_start stamp_expire |> Timestamp.of_span_exn
+  in
+  let open Api_sig.SigningKeyAnnouncementPS in
+  let r : r = { exchange_pub; anchor_time; duration } in
+  let res = verify ~key:signkey_secmod_key signkey_secmod_sig r in
+  match res with
+  | Error e -> Fmt.error "SigningKeyAnnouncementPS: %s" e
+  | Ok () -> Ok ()
+
+let verify_future_denom ~denom_secmod_key
+    FutureDenom.
+      {
+        section_name;
+        value;
+        stamp_start;
+        stamp_expire_withdraw;
+        stamp_expire_deposit;
+        stamp_expire_legal;
+        denom_pub;
+        fee_withdraw;
+        fee_deposit;
+        fee_refresh;
+        fee_refund;
+        denom_secmod_sig;
+      } =
+  let h_denom_pub =
+    DenominationHash.hash (DenominationKey.to_octets denom_pub)
+  in
+  let h_section_name = Hash_64_cstr.hash section_name in
+  let anchor_time = stamp_start in
+  let duration_withdraw =
+    Timestamp.diff stamp_start stamp_expire_withdraw |> Timestamp.of_span_exn
+  in
+  let open Api_sig.DenominationKeyAnnouncementPS in
+  let r : r = { h_denom_pub; h_section_name; anchor_time; duration_withdraw } in
+  let res = verify ~key:denom_secmod_key denom_secmod_sig r in
+  match res with
+  | Error e -> Fmt.error "DenominationKeyAnnouncementPS: %s" e
+  | Ok () -> Ok ()
+
+let verify_future_keys_response
+    FutureKeysResponse.
+      {
+        future_denoms;
+        future_signkeys;
+        master_pub= _;
+        denom_secmod_public_key;
+        signkey_secmod_public_key;
+      } =
+  let open Syntax in
+  let* () =
+    list_iter
+      (verify_future_denom ~denom_secmod_key:denom_secmod_public_key)
+      future_denoms
+  in
+  let* () =
+    list_iter
+      (verify_future_signkey ~signkey_secmod_key:signkey_secmod_public_key)
+      future_signkeys
+  in
   Ok ()