code wiki / (root) / nx_jose_es256.nx

nx_jose_es256.nx

buildroot/runtime/nx_jose_es256.nx

7331 B180 linesdepth 11pulls 23 transitivereach 3 importersview sourcekind tool
docsdependenciesstructsconstsfunctions

about

nx_jose_es256.nx -- ES256 (ECDSA P-256 + SHA-256) JWS flattened signing, RFC 7515/7518. The Ed25519 path (nx_jose) is sovereign but Let's Encrypt's production CA requires ES256 (or RS256) account keys and issues ECDSA/RSA certs -- never Ed25519 -- so the ACME client needs this. Standalone (does NOT import nx_jose) so the whole import graph stays on nx_syscalls.nx -- nx_jose pulls nx_syscalls_x86_64.nx which would double-define every sys_* against the P-256 crypto stack. REUSABLE beyond ACME: JWT ES256, OAuth, WebPush VAPID, etc. ES256 JWS signature is the RAW r||s concatenation (32+32=64 bytes, each big-endian), NOT ASN.1-DER -- RFC 7518 ยง3.4. license_tier: ORIGINAL (composes RFC 7515/7518 + the substrate P-256 stack)

dependencies 8 imports · 1 importers

nx_syscalls.nx nx_jwt.nx nx_sha256.nx nx_u256.nx nx_p256_point.nx nx_p256_scalar_mul.nx nx_ecdsa_p256_sign.nx nx_ecdsa_p256.nx nx_jose_es256.nx nx_acme_es256.nx

imports: nx_syscalls.nxnx_jwt.nxnx_sha256.nxnx_u256.nxnx_p256_point.nxnx_p256_scalar_mul.nxnx_ecdsa_p256_sign.nxnx_ecdsa_p256.nx

imported by: nx_acme_es256.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap u256_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write sys_exit sys_mmap ↻ u256_load_be sys_write ↻ nx_p256_pubkey_from_priv p256_point_alloc nx_scratch ↻ u256_alloc ↻ p256_field_one u256_one u256_zero p256_field_zero u256_zero ↻ p256_point_load_g p256_field_one ↻ p256_scalar_mul nx_scratch_save nx_scratch_init ↻ p256_point_alloc ↻ p256_point_copy u256_copy p256_point_zero p256_field_one ↻ p256_field_zero ↻ p256_point_double p256_point_is_infinity u256_is_zero p256_point_zero ↻ u256_is_zero ↻ nx_scratch_save ↻ u256_alloc ↻ u256_copy ↻

structs

none

consts

26const NXES_MAGIC_4096: i64 = 4096
28const NXES_OK: i64 = 0
29const NXES_BAD_ARG: i64 = 1
30const NXES_OOM: i64 = 2
31const NXES_SIGN_ERR: i64 = 3

functions

34func nxes_put_cstr(out: *u8, off: *i64, cap: i64, s: *u8) -> i64 {
called by 6: nx_acme_es256_protected_jwk_formnx_acme_es256_protected_kid_formnx_acme_payload_new_accountnx_acme_payload_new_ordernx_acme_payload_finalizenx_jose_sign_es256_flattened
42func nxes_put_bytes(out: *u8, off: *i64, cap: i64, src: *u8, n: i64) -> i64 {
called by 7: nx_acme_es256_protected_jwk_formnx_acme_es256_protected_kid_formnx_acme_payload_new_accountnx_acme_payload_new_ordernx_acme_payload_finalizenxes_signature_input+1
52func nx_p256_pubkey_from_priv(priv_limbs: *i64, out_x: *i64, out_y: *i64) -> i64 {
called by 3: mainmainmain calls 5: p256_point_allocp256_point_load_gp256_scalar_mulp256_point_to_affineu256_copy
64func nxes_signature_input(protected_json: *u8, prot_n: i64,
called by 2: nx_jose_sign_es256_flattenedmain calls 3: sys_mmapjwt_b64url_encodenxes_put_bytes
84func nx_jose_sign_es256_flattened(
called by 3: nx_acme_build_new_account_jws_es256acme_signed_postmain calls 10: sys_mmapnxes_signature_inputsha256_digestu256_allocu256_load_benx_ecdsa_p256_sign+4
134func main() -> i64 {
calls 10: sys_mmapu256_allocu256_load_besys_writenx_p256_pubkey_from_privnx_jose_sign_es256_flattened+4