nx_jose.nx
buildroot/runtime/nx_jose.nx
about
nx_jose.nx -- JOSE JWS flattened-JSON signing (RFC 7515 + RFC 8037).
Closes the JWS gap for ACME (RFC 8555). ACME requests are wrapped
in JWS flattened-JSON-serialization, with EdDSA (RFC 8037) being
one accepted signing algorithm.
The JWS flattened-JSON shape (RFC 7515 §7.2.2):
{
"protected": "<b64url(protected_header)>",
"payload": "<b64url(payload_bytes)>",
"signature": "<b64url(signature_bytes)>"
}
Signature input (RFC 7515 §5.1):
b64url(protected_header) || "." || b64url(payload)
(yes -- the literal ASCII dot is included in the signed bytes).
Per cardinal feedback-no-third-party-trust-native-or-nothing:
substrate ships its own JWS signer; no openssl-jose / pyjwt dep.
Supported algorithms today:
EdDSA (RFC 8037 §3.1) -- composes ed25519_sign_full
Queued (separate slices):
ES256 (ECDSA P-256 + SHA-256) -- needs nx_p256
RS256 (RSA + SHA-256) -- needs nx_rsa
nx_capability_claims:
needs: [sealed_enum, b64url, ed25519_sign, json_emit]
provides: [jws_flattened_json_sign_eddsa, jws_signature_input]
safety: [no_unchecked_deref, no_floating_point,
bit_equal_reproducible, target_agnostic,
caller_supplies_protected_header]
verdict: [sealed_enum_6_state]
license: ORIGINAL
kind: racing_crew_specialist
layer: L4 (composite over L3 ed25519 + b64url + json)
dependencies 3 imports · 2 importers
imports: nx_syscalls_x86_64.nxnx_jwt.nxnx_ed25519_signature.nx
imported by: nx_acme.nxnx_jose_test.nx
structs
| none |
consts
| 48 | const NXJOSE_OK: i64 = 0 |
| 49 | const NXJOSE_OOM_BUFFER: i64 = 1 |
| 50 | const NXJOSE_BAD_KEY_LEN: i64 = 2 |
| 51 | const NXJOSE_BAD_ALG: i64 = 3 |
| 52 | const NXJOSE_SIGN_ERR: i64 = 4 |
| 53 | const NXJOSE_BAD_ARG: i64 = 5 |
| 54 | const NXJOSE_VERDICT_N: i64 = 6 |
| 74 | const NXJOSE_ALG_EDDSA: i64 = 0 |
| 75 | const NXJOSE_ALG_N: i64 = 1 // ES256, RS256 queued |
functions
| 56 | func nxjose_verdict_is_valid(v: i64) -> i64 called by 1: main |
| 62 | func nxjose_verdict_name(v: i64) -> *u8 |
| 77 | func nxjose_alg_is_valid(a: i64) -> i64 called by 1: main |
| 85 | func nxjose_put(out: *u8, off: *i64, cap: i64, b: i64) -> i64 |
| 92 | func nxjose_put_cstr(out: *u8, off: *i64, cap: i64, s: *u8) -> i64 |
| 102 | func nxjose_put_bytes(out: *u8, off: *i64, cap: i64, src: *u8, n: i64) -> i64 |
| 122 | func nx_jose_signature_input( |
| 170 | func nx_jose_sign_eddsa_flattened( |