nx_mfa.nx

buildroot/runtime/nx_mfa.nx

4196 B73 linesdepth 5pulls 6 transitivereach 4 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_mfa.nx -- ADMIN MFA / second factor (closes hosting_research gap #12 "mfa-admin", 2/0 CONFIRMED: admin login is single-factor password only). Sovereign TOTP verification (RFC 6238, HMAC-SHA1 -- the Google Authenticator / Authy / Microsoft Authenticator / Duo default) on top of the already-KAT'd nx_totp_sha1 + nx_base32. The login composes mfa_verify AFTER the argon2id password check, so a stolen password alone is not enough. Why SHA-1 (not nx_otp's SHA-256): authenticator apps default to and widely ONLY support HMAC-SHA1 TOTP; SHA-1's collision weakness is irrelevant to HMAC's PRF security (NIST + RFC 6238 both keep HMAC-SHA1 for OTP). Standard params: 6 digits, 30s step, +/-1 step skew window. module: nishi-core.auth.mfa capability: ACCESS_CONTROL / auth

dependencies 3 imports · 2 importers

imports: nx_totp_sha1.nxnx_base32.nxnx_syscalls.nx

imported by: nx_cms_admin.nxnx_mfa_gate.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const MFA_STEP: i64 = 30 // RFC 6238 default time-step (seconds)
15	const MFA_DIGITS: i64 = 6 // authenticator-app default
16	const MFA_WINDOW: i64 = 1 // accept the code for step-1 / step / step+1 (RFC 6238 SS5.2 skew tolerance)
17	const MFA_KEY_BYTES: i64 = 20 // 160-bit secret (RFC 4226 SS4 recommends >= 128 bits, 160 preferred)

functions

20	func mfa_ct_eq(a: u8, b: u8, n: i64) -> i64 called by 1: mfa_verify
29	func mfa_verify(secret_b32: u8, b32_len: i64, code: u8, code_len: i64, now_unix: i64, window: i64) -> i64 called by 2: ca_mfa_ok main calls 5: sys_mmap base32_decode hotp_sha1_value totp_sha1_render mfa_ct_eq
48	func mfa_enrolled(secret_b32: *u8, b32_len: i64) -> i64 { if b32_len >= 16 { return 1 } return 0 } called by 3: ca_mfa_ok main main
52	func mfa_gen_secret(out_b32: *u8) -> i64 called by 1: main calls 5: sys_mmap sys_openat_rd sys_read sys_close base32_encode
61	func mfa_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main calls 1: sys_write
63	func main() -> i64 calls 9: sys_mmap mfa_gen_secret mfa_p sys_write sys_now_realtime_sec base32_decode+3