nx_ecdsa_sig_der.nx

nx_ecdsa_sig_der.nx -- parse DER-encoded ECDSA signatures into (r, s) scalars. Phase 0b §I.4 piece 1 of the chain-walker arc. Composes the shipped nx_ecdsa_p256_verify (commit 6bd3fdf3) with X.509 cert.sig_off/_len bytes (which carry the ECDSA signature in DER form per RFC 5480 §2.2). ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER } Per RFC 3279 §2.2.3 and X.690 §8.3, the INTEGER encoding is two's-complement big-endian. A 256-bit unsigned ECDSA scalar in [0, n) thus encodes as either: - 32 bytes when its leading bit is 0 (positive small) - 33 bytes when its leading bit is 1 (must prefix 0x00 to stay positive in two's complement) - fewer than 32 bytes when leading zero bytes get stripped We accept all of these widths and zero-extend / strip-prefix as needed to produce a canonical 8-limb LE U256 in [0, n). The caller (ecdsa_p256_verify) range-checks r and s against n itself. Public API: nx_ecdsa_sig_parse_der(buf, len, out_r, out_s) -> verdict nx_ecdsa_sig_der_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_ECDSA_DER_OK sig parsed cleanly NX_ECDSA_DER_BAD_OUTER outer SEQUENCE missing / wrong tag NX_ECDSA_DER_BAD_R r INTEGER malformed NX_ECDSA_DER_BAD_S s INTEGER malformed NX_ECDSA_DER_LEN_TOO_BIG r or s longer than 33 bytes (won't fit a 256-bit scalar; not a valid ECDSA-P256 / ECDSA-P384 sig either) NX_ECDSA_DER_TRAILING bytes left after parsing both INTEGERs (malformed sig)