nx_jwk_ec.nx
buildroot/runtime/nx_jwk_ec.nx
about
nx_jwk_ec.nx -- EC P-256 public-key JWK (RFC 7518 §6.2) + RFC 7638
canonical thumbprint. Needed by the ACME client: the new-account
JWS "jwk" header embeds the account public key as an EC JWK, and the
DNS-01 key authorization is token "." base64url(SHA-256(thumbprint)).
Standalone (no nx_jose import) so the graph stays on nx_syscalls.nx.
REUSABLE: any EC-P256 JWK consumer (JWT, OIDC, WebAuthn attestation).
EC JWK (RFC 7518 §6.2.1):
{"crv":"P-256","kty":"EC","x":"<b64url(X,32)>","y":"<b64url(Y,32)>"}
RFC 7638 thumbprint input = the SAME bytes (members lexicographic:
crv, kty, x, y -- already in order), SHA-256'd.
license_tier: ORIGINAL (composes RFC 7518/7638 + the P-256 stack)
dependencies 4 imports · 1 importers
imports: nx_syscalls.nxnx_jwt.nxnx_sha256.nxnx_u256.nx
imported by: nx_acme_es256.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 21 | const NXJWK_OK: i64 = 0 |
| 22 | const NXJWK_OOM: i64 = 1 |
functions
| 24 | func jwkec_put(out: *u8, off: *i64, cap: i64, s: *u8) -> i64 called by 1: nx_jwk_ec_p256_emit |
| 32 | func jwkec_put_bytes(out: *u8, off: *i64, cap: i64, src: *u8, n: i64) -> i64 called by 1: nx_jwk_ec_p256_emit |
| 43 | func nx_jwk_ec_p256_emit(out: *u8, off: *i64, cap: i64, |
| 63 | func nx_jwk_ec_p256_thumbprint(x_limbs: *i64, y_limbs: *i64, out_32: *u8) -> i64 called by 3: nx_acme_key_authorizationnx_acme_dns01_txt_valuemain calls 3: sys_mmapnx_jwk_ec_p256_emitsha256_digest |
| 73 | func main() -> i64 |