code wiki / _hdl_build / nx_machine_key.nx

nx_machine_key.nx

buildroot/runtime/_hdl_build/nx_machine_key.nx

9704 B198 linesdepth 5pulls 10 transitivereach 0 importersview sourcekind tooltopic machine
docsdependenciesstructsconstsfunctions

about

nx_machine_key.nx -- MACHINE-BOUND key derivation for the sovereign vault (operator's own-cybersecurity choice: option 2, unattended, hardened as far as software allows). Derives the vault passphrase from machine-LOCAL identity (/etc/machine-id + hostname) mixed with a repo-stored PEPPER, via heavily-iterated SHA-256. Writes it to /tmp/nxpass for the gated nx_vault to consume, then the Warden shreds it. No human prompt; the key never exists on disk -- it is RECONSTRUCTED each run from machine state. HONEST THREAT MODEL (recorded so nobody overclaims): DEFEATS: repo/backup leaks, file theft, cloud sync exposure, a copied vault file alone. DOES NOT DEFEAT a nation-state with PHYSICAL ACCESS to this exact machine + the binary: a machine-bound key is, by construction, re-derivable from the machine. True resistance to that requires a HARDWARE ROOT OF TRUST (TPM2 / the NAS secure element) holding a key that never leaves silicon -- that is the FLAGGED hardware build, not deliverable in software. argon2id (memory-hard, already in the team) replacing the SHA-256 stretch is the next software rung. license_tier: ORIGINAL

dependencies 4 imports · 0 importers

nx_syscalls.nx nx_itoa_lib.nx nx_sha256.nx nx_argon2id.nx nx_machine_key.nx

imports: nx_syscalls.nxnx_itoa_lib.nxnx_sha256.nxnx_argon2id.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main _p sys_write mk_streq sys_mmap mk_read sys_openat_rd sys_read sys_close mk_chomp sha256_init sys_mmap ↻ sha256_k sha256_update sha256_compress_ni_blocks blk_set_byte sha256_compress sha256_compress_ni blk_word blk_byte sha256_final blk_set_byte ↻ sha256_compress ↻ mk_hex mk2_ctx sys_mmap ↻ nx_argon2id_hash _ar2_h0 _ar2_write_le32 nx_blake2b_hash nx_blake2b_init _b2b_iv nx_blake2b_update _b2b_compress _b2b_load_u64_le _b2b_iv ↻ _b2b_mix _b2b_sigma nx_blake2b_final _b2b_compress ↻

structs

none

consts

20const MK_MAGIC_1024: i64 = 1024
21const MK_MAGIC_2048: i64 = 2048
31const MK_ITERS: i64 = 500000
35const MK2_M_KIB: i64 = 32768
36const MK2_T: i64 = 3
37const MK2_P: i64 = 1

functions

39func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 1: main calls 1: sys_write
44func _pn(v: i64) -> i64 { nxi_out(v); return 0 }
calls 1: nxi_out
45func mk_read(path: *u8, out: *u8, cap: i64, lenbox: *i64) -> i64
called by 1: main calls 3: sys_openat_rdsys_readsys_close
60func mk_chomp(buf: *u8, len: i64) -> i64
called by 1: main
66func mk_hex(dig: *u8, out: *u8) -> i64
called by 1: main
77func mk2_ctx(m_kib: i64) -> *NxArgon2idCtx
called by 1: main calls 1: sys_mmap
100func mk_streq(a: *u8, b: *u8) -> i64
called by 1: main
109func mk_uidpath(out: *u8) -> i64
called by 1: main calls 1: sys_mmap
122func main(argc: i64, argv: *i64) -> i64
calls 16: _pmk_streqsys_mmapmk_readmk_chompsha256_init+10