nx_mtls_ecdsa.nx
buildroot/runtime/nx_mtls_ecdsa.nx
about
nx_mtls_ecdsa.nx -- ECDSA-P256 OPAQUE-bound client identity cert (the guaranteed-browser-interop branch).
mTLS rung R5c: Chrome/Edge + the Windows cert store reliably present ECDSA-P256 client certs (Ed25519
client-cert support is spotty), so this is the interop-safe identity. Same shape as the Ed25519 path
(R4/R5) but P-256: derive a deterministic P-256 keypair from the OPAQUE export_key (private key never
stored server-side), then mint a self-signed ECDSA-with-SHA256 leaf cert (Subject CN = hex(user_id_hash)).
Imports ONLY hub/nx_x509_build (the proven pattern from nx_acme_csr) -- nx_x509_build_self_signed dispatches
the ECDSA path (SHA-256(TBS) -> nx_ecdsa_p256_sign -> DER). Cert correctness is proven by openssl + python
(dev-time oracle). The in-process ECDSA CertificateVerify path (R3-ecdsa) lives in nx_tls13_clientauth_ecdsa.
license_tier: ORIGINAL expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnx_x509_build.nxnx_p256_ecdh.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 15 | const NX_MAGIC_4096: i64 = 4096 |
| 17 | const NX_ME_OK: i64 = 0 |
| 18 | const NX_ME_ERR: i64 = 1 |
functions
| 21 | func nx_me_hex(src: *u8, n: i64, out: *u8) -> i64 called by 1: nx_mtls_ecdsa_mint_cert |
| 31 | func nx_mtls_ecdsa_mint_cert( called by 1: main calls 11: sys_mmapp256_ecdh_derive_privu256_allocu256_load_bep256_point_allocp256_point_load_g+5 |
| 56 | func ec_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 57 | func ec_putn(v: i64) -> i64 { let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0; if m==0 { t[0]=48 as u8; k=1 } while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } let o: *u8 = sys_mmap(24); var i: i64=0; while i<k { o[i]=t[k-1-i]; i=i+1 } sys_write(1,o,k); return 0 } |
| 59 | func main() -> i64 |