code wiki / _hdl_build / nx_connect_2fa.nx
nx_connect_2fa.nx
buildroot/runtime/_hdl_build/nx_connect_2fa.nx
about
nx_connect_2fa.nx -- CONNECT two-factor account protection (the SEC census cell).
The full 2FA STATE MACHINE, gated: enroll (secret + single-use recovery codes) -> verify with a
+-1 time-step window -> consecutive-fail LOCKOUT -> recovery-code unlock (consumed on use) ->
fail-closed unknown-user refusal. NEG-CONTROL: a no-lockout incumbent model lets a brute-force
run keep guessing; ours hard-stops it at the threshold.
HONEST SCOPE (the nx_connect_msg-AEAD / nx_connect_idage-ed25519 precedent): the OTP function
here is a DETERMINISTIC KEYED-MIX STAND-IN that proves the state machine's information flow;
the production drop-in is RFC 6238 TOTP over runtime/nx_hmac_sha1.nx (RFC 2202-verified, already
in-tree; unimportable into this gate only because it carries its own smoke main()). No crypto
strength is claimed by this gate. 100% sovereign. license_tier: ORIGINAL expect_exit: 0
dependencies 1 imports · 0 importers
imports: nx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 12 | const FA_MAGIC_2654435761: i64 = 2654435761 |
| 13 | const FA_MAGIC_1103515245: i64 = 1103515245 |
| 14 | const FA_MAGIC_12345: i64 = 12345 |
| 15 | const FA_MAGIC_65536: i64 = 65536 |
| 16 | const FA_MAGIC_2246822519: i64 = 2246822519 |
| 17 | const FA_MAGIC_8192: i64 = 8192 |
| 18 | const FA_MAGIC_1000000: i64 = 1000000 |
| 19 | const FA_MAGIC_987654321: i64 = 987654321 |
| 20 | const FA_MAGIC_111222: i64 = 111222 |
| 21 | const FA_MAGIC_333444: i64 = 333444 |
| 22 | const FA_MAGIC_555666: i64 = 555666 |
| 23 | const FA_MAGIC_2000: i64 = 2000 |
| 24 | const FA_MAGIC_123456: i64 = 123456 |
| 25 | const FA_MAGIC_3000: i64 = 3000 |
| 27 | const FA_MAXU: i64 = 8 |
| 28 | const FA_NREC: i64 = 3 |
| 29 | const FA_LOCK_AT: i64 = 5 |
functions
| 31 | func sw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } |
| 32 | func sn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } |
| 33 | func tcheck(pass: i64, label: *u8, fails: *i64) -> i64 |
| 41 | func fa_otp(secret: i64, tstep: i64) -> i64 |
| 55 | func fa_verify(ctx: *i64, uidx: i64, code: i64, tstep: i64) -> i64 |
| 75 | func fa_recover(ctx: *i64, uidx: i64, rcode: i64) -> i64 called by 1: main |
| 95 | func fa_verify_nolock(secret: i64, code: i64, tstep: i64) -> i64 |
| 100 | func main() -> i64 |