code wiki / _hdl_build / nx_dr_encrypt.nx

nx_dr_encrypt.nx

buildroot/runtime/_hdl_build/nx_dr_encrypt.nx

4826 B73 linesdepth 6pulls 9 transitivereach 0 importersview sourcekind tooltopic dr

docs dependencies structs consts functions

about

nx_dr_encrypt.nx -- CAP-DR-ENCRYPT: encryption-at-rest for the DR archive. Composes the VETTED RFC-8439 ChaCha20-Poly1305 AEAD (nx_chacha20_poly1305) -- NOT hand-rolled crypto. key = sha256(keyfile) (operator-held passphrase, never on the command line); nonce = sha256(plaintext)[0..12] (CONVERGENT: distinct plaintext -> distinct nonce, so no reuse per key; reproducible). Sealed file = [nonce:12][tag:16][ciphertext:N]. open() checks the Poly1305 tag FIRST (constant-time) -> tampering / wrong-key = rejected, plaintext never emitted. So the accounts never sit in plaintext on /mnt/d, and any corruption is cryptographically detected. nx_dr_encrypt seal <plain-in> <enc-out> <keyfile> nx_dr_encrypt open <enc-in> <plain-out> <keyfile> license_tier: ORIGINAL (composes nx_chacha20_poly1305 + nx_sha256)

dependencies 3 imports · 0 importers

imports: nx_syscalls.nxnx_sha256.nxnx_chacha20_poly1305.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

13	const E_MAGIC_65536: i64 = 65536
32	const E_CAP: i64 = 67108864

functions

15	func e_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main calls 1: sys_write
16	func e_wn(v: i64) -> i64 { var t: i64=v; if t<0{sys_write(1,"-" as u8,1);t=0-t} let tm:u8=sys_mmap(24); var k:i64=0; if t==0{tm[0]=48 as u8;k=1} while t>0{tm[k]=(48+(t%10)) as u8;t=t/10;k=k+1} let b:*u8=sys_mmap(24); var j:i64=0; while j<k{b[j]=tm[k-1-j];j=j+1} sys_write(1,b,k); return 0 } called by 1: main calls 2: sys_write sys_mmap
17	func e_read(path: u8, out: u8, cap: i64) -> i64 called by 2: e_key main calls 3: sys_openat_rd sys_read sys_close
23	func e_write(path: u8, buf: u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd < 0 { return 0 - 1 } sys_write(fd, buf, n); sys_close(fd); return n } called by 1: main calls 3: sys_openat_wr sys_write sys_close
24	func e_streq(a: u8, b: u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8) { if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8) { return 0 } return 1 } called by 1: main
26	func e_key(keyfile: u8, keyout: u8) -> i64 called by 1: main calls 3: sys_mmap e_read sha256_digest
34	func main(argc: i64, argv: *i64) -> i64 calls 11: e_w sys_exit sys_mmap e_key e_streq e_read+5