48 lines
2.1 KiB
OCaml
48 lines
2.1 KiB
OCaml
(* TODO
|
||
|
||
https://docs.taler.net/taler-exchange-manual.html#offline-signing-setup-key-maintenance-and-tear-down
|
||
|
||
The exchange HTTP service must be running before you can complete the following offline signing procedure. Note that when an exchange is running without offline keys its not fully operational. To make the exchange HTTP service fully operational, the following steps involving the offline signing machine must be completed:
|
||
|
||
1) The public keys of various online keys used by the exchange service are exported via a management HTTP API.
|
||
|
||
2) The offline signing system validates this request and signs it.
|
||
Additionally, the offline signing system signs policy messages to configure the exchange’s bank
|
||
accounts and associated fees.
|
||
|
||
3) The messages generated by the offline signing system are uploaded via the management API
|
||
of the exchange HTTP service.
|
||
*)
|
||
|
||
(*
|
||
- generate (pub&priv) key for online signing key
|
||
- generate (pub&priv) key for denomination(s)
|
||
- implement `GET /management/keys`
|
||
- implement `POST /management/keys`
|
||
- offline tool do: GET -> sign -> POST
|
||
- now we should have a server with valid keys signed by the master offline key *)
|
||
(* implement secmod / crytpo stuff as a vif device *)
|
||
|
||
(* https://docs.taler.net/core/api-common.html#cryptographic-primitives
|
||
|
||
All elliptic curve operations are on Curve25519.
|
||
Public and private keys are thus 32 bytes, and signatures 64 bytes.
|
||
For hashing, including HKDFs, Taler uses 512-bit hash codes (64 bytes). *)
|
||
|
||
type key =
|
||
| Eddsa of Mirage_crypto_ec.Ed25519.(priv * pub)
|
||
| Rsa of Mirage_crypto_pk.Rsa.(priv * pub)
|
||
|
||
let eddsa_online_key_device =
|
||
let finally _key = () in
|
||
Vif.Device.v ~name:"eddsa_online_key" ~finally [] @@ fun () ->
|
||
(* [Mirage_crypto_rng_miou_unix.(initialize (module Pfortuna))] is already done by [Vif.run] *)
|
||
Eddsa (Mirage_crypto_ec.Ed25519.generate ())
|
||
|
||
let rsa_denomination_key_device =
|
||
let finally _key = () in
|
||
Vif.Device.v ~name:"rsa_denomination_key" ~finally [] @@ fun () ->
|
||
let open Mirage_crypto_pk.Rsa in
|
||
let rsa_keysize = 2048 in
|
||
let priv = generate ~bits:rsa_keysize () in
|
||
Rsa (priv, pub_of_priv priv)
|