nx_email_auth.nx
buildroot/runtime/nx_email_auth.nx
about
nx_email_auth.nx -- EMAIL RUNG R5: sender authentication / anti-spoof.
module: nishi-core.email.auth
depends: nishi-core.crypto.ed25519_signature, nishi-core.crypto.sha256
capability: CORE_EMAIL
The trust layer that decides whether a message genuinely comes from
the domain it claims. Three standards, composed from existing
sovereign crypto (nx_sha256 + the REAL ed25519 sign/verify in
nx_ed25519_signature) -- nothing re-implemented:
DKIM (RFC 6376 + RFC 8463 ed25519-sha256): body hash = SHA-256 of
the "simple"-canonicalised body (trailing empty lines folded
to one CRLF); the canonicalised signed-header set is hashed
with SHA-256 and that digest is signed/verified with Ed25519.
A flipped body byte changes bh=; a flipped signed header
fails the signature.
SPF (RFC 7208): evaluate "v=spf1 ip4:.../cidr ... -all" against a
connecting IPv4 -> PASS / FAIL / SOFTFAIL / NEUTRAL / NONE.
DMARC (RFC 7489): parse "v=DMARC1; p=..." -> none/quarantine/reject
(the "p=" tag, boundary-anchored so "sp=" never matches).
SCOPE (honest, no over-claim): SPF supports ip4 + all (include:/a/mx
recursion and relaxed DKIM canonicalisation + RFC 2047 are later
sub-rungs). Per the no-wave law this rung is graded on the crypto
round-trip + parse correctness + tamper rejection, NOT byte-for-byte
interop with a third-party verifier yet.
license_tier: INDEPENDENT_REDERIVE
genealogy_id: international-research-sources/ietf/rfc_6376 + rfc_8463 + rfc_7208 + rfc_7489
lineage_id: nishi_email_auth_r5
nx_safety_envelope:
intended_use: "DKIM ed25519-sha256 sign/verify + body hash;
SPF ip4 eval; DMARC policy parse. Anti-spoof."
sil_target: SIL3 (a verify bug accepts forged mail)
evidence: [composes_real_ed25519+sha256, dkim_roundtrip,
body_canon_idempotent, tamper_rejected,
spf_cidr_match, dmarc_boundary_anchored]
hazard_register: [bug-tape-DKIM-forgery-accept,
dependencies 3 imports · 4 importers
imports: nx_ed25519_signature.nxnx_sha256.nxnx_syscalls.nx
imported by: nx_email_auth_gate.nxnx_email_dns_gate.nxnx_email_provision_lib.nxnx_email_send.nx
structs
| none |
consts
| 51 | const NX_SPF_NONE: i64 = 0 |
| 52 | const NX_SPF_PASS: i64 = 1 |
| 53 | const NX_SPF_FAIL: i64 = 2 |
| 54 | const NX_SPF_SOFTFAIL: i64 = 3 |
| 55 | const NX_SPF_NEUTRAL: i64 = 4 |
| 58 | const NX_DMARC_NOREC: i64 = 0 |
| 59 | const NX_DMARC_NONE: i64 = 1 |
| 60 | const NX_DMARC_QUARANTINE: i64 = 2 |
| 61 | const NX_DMARC_REJECT: i64 = 3 |
functions
| 63 | func nx_spf_name(v: i64) -> *u8 |
| 70 | func nx_dmarc_name(v: i64) -> *u8 |
| 78 | func ea_match(a: *u8, b: *u8, len: i64) -> i64 |
| 89 | func nx_dkim_body_hash(body: *u8, n: i64, scratch: *u8, scap: i64, out32: *u8) -> i64 |
| 104 | func nx_dkim_sign(headers: *u8, hn: i64, priv32: *u8, sig64: *u8) -> i64 |
| 111 | func nx_dkim_verify(headers: *u8, hn: i64, pub32: *u8, sig64: *u8) -> i64 |
| 121 | func spf_qual(q: i64) -> i64 called by 1: nx_spf_eval |
| 129 | func spf_parse_ip4(s: *u8, slen: i64, net_p: *i64, mask_p: *i64) -> i64 called by 1: nx_spf_eval |
| 160 | func nx_spf_eval(rec: *u8, rlen: i64, ip4: i64) -> i64 |
| 199 | func nx_dmarc_policy(rec: *u8, rlen: i64) -> i64 |