nx_ltv_lib.nx
buildroot/runtime/nx_ltv_lib.nx
about
nx_ltv_lib.nx -- PAdES LONG-TERM VALIDATION (ETSI EN 319 142 baseline levels B-B/B-T/B-LT/B-LTA).
The gap this closes: a signature that verifies TODAY is worthless if it cannot be verified in the year
the dispute actually reaches a court. Signing certificates expire in 1-3 years; litigation and record
retention run 7-30. Once the certificate expires -- or the issuing CA's OCSP responder goes dark, or
the CA dissolves -- a verifier can no longer fetch the revocation status the signature depends on.
THE LEVELS, each strictly containing the last:
B-B signed attributes + the signer certificate (verifiable only while the cert lives)
B-T + a trusted timestamp token (proves WHEN it was signed)
B-LT + the certificate chain AND revocation data EMBEDDED (carries its own proof; no live CA)
B-LTA + an archive timestamp over the whole structure (survives crypto obsolescence)
THE TOOTH EVERY NAIVE VERIFIER GETS WRONG: when a signature can no longer be checked the answer is
INDETERMINATE, *not* INVALID. Those are opposite legal outcomes -- INVALID says forged or tampered;
INDETERMINATE says our evidence decayed. Reporting an expired-cert B-level signature as "invalid"
impeaches a document that was perfectly validly signed. The verdict is THREE-valued so the
distinction cannot be collapsed into a boolean, which is exactly how it gets lost.
THE SECOND TOOTH: long-term validation is NOT a laundry. A certificate already REVOKED at signing
time stays INVALID at B-LTA -- embedding proof of a bad status proves the status was bad.
STRUCTURE (two layers, deliberately): a PURE DECISION CORE holding the level and verdict rules as
total functions, and REGISTRY ADAPTERS that fetch components and delegate. The rules therefore gate
with ZERO writes and cannot be held hostage by a storage stall (debt 1785519597), and there is
exactly one copy of each rule so the two layers can never disagree.
SCALE ENVELOPE (declared): pure core O(1), allocation-free; adapters one reg_get per component.
DRY: composes nx_matter_lib. license_tier: ORIGINAL LIB.
dependencies 1 imports · 3 importers
imports: nx_matter_lib.nx
imported by: nx_legal_svc.nxnx_ltv_gate.nxnx_ltv_pure_gate.nx
structs
| none |
consts
| 32 | const LTV_NONE: i64 = 0 |
| 33 | const LTV_B: i64 = 1 |
| 34 | const LTV_T: i64 = 2 |
| 35 | const LTV_LT: i64 = 3 |
| 36 | const LTV_LTA: i64 = 4 |
| 38 | const LTV_INDETERMINATE: i64 = 0 |
| 39 | const LTV_VALID: i64 = 1 |
| 41 | const LTV_UNSET: i64 = 0 - 2000000002 |
| 42 | const LTV_INVALID: i64 = 0 - 1 |
| 44 | const LTV_RECBUF: i64 = 512 |
| 45 | const LTV_IDBUF: i64 = 256 |
functions
| 52 | func ltv_is1(v: i64) -> i64 |
| 59 | func ltv_level_pure(signed_attrs: i64, signer_cert: i64, ts: i64, chain: i64, revoc: i64, archive: i64) -> i64 |
| 70 | func ltv_self_contained_pure(level: i64) -> i64 |
| 76 | func ltv_verify_pure(level: i64, revoked: i64, asof: i64, expiry: i64) -> i64 |
| 87 | func ltv_needs_renewal_pure(level: i64, asof: i64, sunset: i64, renewed: i64) -> i64 |
| 102 | func ltv_key(sig: *u8, field: *u8, out: *u8) -> i64 |
| 111 | func ltv_set(prefix: *u8, sig: *u8, field: *u8, val: *u8) -> i64 |
| 123 | func ltv_get(prefix: *u8, sig: *u8, field: *u8, out: *u8) -> i64 |
| 136 | func ltv_yes(prefix: *u8, sig: *u8, field: *u8) -> i64 |
| 144 | func ltv_atoi(s: *u8) -> i64 called by 1: ltv_getn |
| 163 | func ltv_setn(prefix: *u8, sig: *u8, field: *u8, n: i64) -> i64 |
| 175 | func ltv_getn(prefix: *u8, sig: *u8, field: *u8) -> i64 |
| 185 | func ltv_level(prefix: *u8, sig: *u8) -> i64 |
| 189 | func ltv_self_contained(prefix: *u8, sig: *u8) -> i64 |
| 193 | func ltv_verify_at(prefix: *u8, sig: *u8, asof_day: i64, cert_expiry_day: i64) -> i64 |
| 197 | func ltv_needs_renewal(prefix: *u8, sig: *u8, asof_day: i64, algo_sunset_day: i64) -> i64 |
| 201 | func ltv_renew(prefix: *u8, sig: *u8, day: i64) -> i64 calls 1: ltv_setn |
| 205 | func ltv_level_label(lvl: i64, out: *u8) -> i64 |
| 215 | func ltv_verdict_label(v: i64, out: *u8) -> i64 |