package dkim

  1. Overview
  2. Docs

Module Dkim.DigestSource

Digest computation

The Digest module computes the cryptographic digests that underlie a DKIM signature. A signature covers two digests: one over a selection of header fields (including the DKIM-Signature header with the b= tag emptied), and one over the canonicalized message body.

Sourcetype 'a dkim = 'a t

Alias for the outer DKIM record type, re-exported inside Digest to avoid shadowing by the local t.

Sourcetype 'k t =
  1. | Digest : {
    1. m : ('k, 'ctx) impl;
    2. ctx : 'ctx;
    } -> 'k t

An in-progress hash computation, existentially quantified over the hash algorithm.

Sourceand ('k, 'ctx) impl = (module Digestif.S with type ctx = 'ctx and type t = 'k)

A first-class module type pairing a Digestif implementation with its key and context types.

Sourceand ('signed, 'k) value = 'signed dkim * 'k t

A pair of a DKIM record and its corresponding in-progress digest. The 'signed parameter tracks whether the record is signed or unsigned.

Sourceand pack =
  1. | Value : (signed, 'k) value -> pack

An existentially packed (signed, 'k) value, hiding the hash type.

Sourceval digest_fields : (Mrmime.Field_name.t * Unstrctrd.t) list -> (Mrmime.Field_name.t * Unstrctrd.t * signed dkim * domain_key) -> string * pack

digest_fields others (field_name, unstrctrd, dkim, domain_key) computes the header digest. others is the list of all header fields (excluding DKIM-Signature) collected from the email. The function selects the fields listed in dkim.h, canonicalizes them, appends the canonicalized DKIM-Signature header (with the b= tag removed), and returns the raw digest bytes together with an initialized body digest ready to receive body data.

Sourceval digest_wsp : [< `CRLF | `Spaces of string ] list -> ('signed, 'k) value -> ('signed, 'k) value

digest_wsp payloads value feeds whitespace and CRLF tokens into the body digest. Under relaxed canonicalization, runs of whitespace are collapsed to a single space.

Sourceval digest_str : string -> ('signed, 'k) value -> ('signed, 'k) value

digest_str data value feeds a chunk of body data (not whitespace) into the body digest.

Sourceval verify : fields:string -> domain_key:domain_key -> (signed, 'k) value -> string * bool

verify ~fields ~domain_key value finalizes the body digest and verifies the DKIM signature. fields is the raw header digest obtained from digest_fields. Returns a pair (body_hash, fields_valid) where body_hash is the raw hash of the canonicalized body and fields_valid is true if the cryptographic signature over the headers is valid.