code wiki / (root) / nx_mtls_pkcs12.nx

nx_mtls_pkcs12.nx

buildroot/runtime/nx_mtls_pkcs12.nx

16869 B230 linesdepth 11pulls 25 transitivereach 2 importersview sourcekind tooltopic mtls
docsdependenciesstructsconstsfunctions

about

nx_mtls_pkcs12.nx -- sovereign PKCS#12 (.p12 / PFX) emitter for one-time browser/OS import (RFC 7292). mTLS rung R5b: package the OPAQUE-bound client identity (Ed25519 key + leaf cert) into a .p12 the user imports ONCE into their browser/OS cert store, after which the browser presents it at the TLS layer on every connection -- the no-cookie carrier. Structure (modern, widely-importable: OpenSSL 3 + Windows 11): PFX = SEQ { version 3, authSafe ContentInfo{data, OCTET STRING( AuthenticatedSafe )}, macData SEQ{ DigestInfo{sha256, MAC}, macSalt, iter } } AuthenticatedSafe = SEQ OF ContentInfo{data, OCTET STRING( SafeContents )} SafeContents = SEQ OF { ShroudedKeyBag(PBES2: PBKDF2-HMAC-SHA256 + AES-128-CBC over PKCS#8), CertBag } MAC key = PKCS12-KDF(BMPString(pw), macSalt, iter, id=3, 32); MAC = HMAC-SHA256 over the AuthenticatedSafe DER. Composes ONLY sovereign, KAT'd primitives: nx_asn1_emit · nx_pbkdf2 · nx_aes_cbc_enc (AES-CBC, NIST F.2.1) · nx_pkcs12_kdf (RFC 7292 B.2) · nx_hmac · sha256 · nx_x509_leaf_emit. The emitted .p12 is validated end-to-end by `openssl pkcs12` (dev-time oracle only; never shipped). license_tier: ORIGINAL expect_exit: 0

dependencies 10 imports · 2 importers

nx_syscalls.nx nx_asn1_emit.nx sha256.nx nx_hmac.nx nx_pbkdf2.nx nx_pkcs12_kdf.nx nx_aes.nx nx_aes_cbc_enc.nx nx_ed25519_signature.nx nx_x509_leaf_emit.nx nx_mtls_pkcs12.nx nx_mtls_issue.nx nx_mtls_pkcs12_ecdsa.nx

imports: nx_syscalls.nxnx_asn1_emit.nxsha256.nxnx_hmac.nxnx_pbkdf2.nxnx_pkcs12_kdf.nxnx_aes.nxnx_aes_cbc_enc.nxnx_ed25519_signature.nxnx_x509_leaf_emit.nx

imported by: nx_mtls_issue.nxnx_mtls_pkcs12_ecdsa.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main p12_puts sys_write sys_mmap ed25519_pub_from_priv sys_mmap ↻ ed25519_sha512 sys_mmap ↻ sha512_init sha512_update sha512_blk_set_byte blk_get_i64 blk_set_i64 sha512_compress sys_mmap ↻ blk_get_i64 ↻ sha512_gamma0 rotr64_v shr64_v sha512_gamma1 rotr64_v ↻ shr64_v ↻ sha512_sigma1 rotr64_v ↻ sha512_ch sha512_k sha512_sigma0 rotr64_v ↻ sha512_maj sha512_final sha512_blk_set_byte ↻ sha512_compress ↻ ge_p3_alloc sys_mmap ↻ fe_alloc nx_scratch nx_scratch_init sys_mmap ↻ nx_scratch_oom sys_write ↻

structs

none

consts

26const K_MAGIC_2048: i64 = 2048
27const K_MAGIC_4096: i64 = 4096
28const K_MAGIC_8192: i64 = 8192

functions

31func p12oid_ed25519(o: *u8) -> i64 { o[0]=0x2b as u8;o[1]=0x65 as u8;o[2]=0x70 as u8; return 3 }
called by 1: nx_mtls_emit_pkcs12
32func p12oid_pbes2(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x05 as u8;o[8]=0x0d as u8; return 9 }
called by 1: nx_mtls_emit_pkcs12_from
33func p12oid_pbkdf2(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x05 as u8;o[8]=0x0c as u8; return 9 }
called by 1: nx_mtls_emit_pkcs12_from
34func p12oid_hmacsha256(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x02 as u8;o[7]=0x09 as u8; return 8 }
called by 1: nx_mtls_emit_pkcs12_from
35func p12oid_aes128cbc(o: *u8) -> i64 { o[0]=0x60 as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x01 as u8;o[4]=0x65 as u8;o[5]=0x03 as u8;o[6]=0x04 as u8;o[7]=0x01 as u8;o[8]=0x02 as u8; return 9 }
called by 1: nx_mtls_emit_pkcs12_from
36func p12oid_sha256(o: *u8) -> i64 { o[0]=0x60 as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x01 as u8;o[4]=0x65 as u8;o[5]=0x03 as u8;o[6]=0x04 as u8;o[7]=0x02 as u8;o[8]=0x01 as u8; return 9 }
called by 1: nx_mtls_emit_pkcs12_from
37func p12oid_data(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x07 as u8;o[8]=0x01 as u8; return 9 }
called by 1: nx_mtls_emit_pkcs12_from
38func p12oid_shroudedkeybag(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x0c as u8;o[8]=0x0a as u8;o[9]=0x01 as u8;o[10]=0x02 as u8; return 11 }
called by 1: nx_mtls_emit_pkcs12_from
39func p12oid_certbag(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x0c as u8;o[8]=0x0a as u8;o[9]=0x01 as u8;o[10]=0x03 as u8; return 11 }
called by 1: nx_mtls_emit_pkcs12_from
40func p12oid_x509cert(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0x86 as u8;o[4]=0xf7 as u8;o[5]=0x0d as u8;o[6]=0x01 as u8;o[7]=0x09 as u8;o[8]=0x16 as u8;o[9]=0x01 as u8; return 10 }
called by 1: nx_mtls_emit_pkcs12_from
43func p12_put_uint(out: *u8, off: *i64, cap: i64, v: i64) -> i64
called by 1: nx_mtls_emit_pkcs12_from calls 1: nxae_put
56func nx_mtls_emit_pkcs12(
called by 2: nx_mtls_issue_identity_p12main calls 7: sys_mmapnxae_put_octet_stringp12oid_ed25519nxae_put_oidnxae_put_int_u8nxae_put_tlv+1
77func nx_mtls_emit_pkcs12_from(
called by 2: nx_mtls_emit_pkcs12main calls 25: sys_mmappbkdf2_sha256aes128_expand_keyaes128_pkcs7_padaes128_cbc_encryptp12oid_hmacsha256+19
208func p12_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
called by 1: main calls 1: sys_write
209func p12_putn(v: i64) -> i64 { let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0; if m==0 { t[0]=48 as u8; k=1 } while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } let o: *u8 = sys_mmap(24); var i: i64=0; while i<k { o[i]=t[k-1-i]; i=i+1 } sys_write(1,o,k); return 0 }
called by 1: main calls 2: sys_mmapsys_write
211func main() -> i64
calls 10: p12_putssys_mmaped25519_pub_from_privnx_x509_leaf_emit_ed25519sys_exitnx_mtls_emit_pkcs12+4