nx_opaque_envelope.nx

nx_opaque_envelope.nx -- V-MODAUTH-2a: RFC 9807 §4 client credential Envelope (Store / Recover). The Envelope is what the server stores INSTEAD of a password hash. It contains NO encrypted secret at all -- just a nonce + MAC. The client's AKE private key is RE-DERIVED from the randomized password (OPRF output -> KSF stretch -> Extract) at every login; the MAC proves the derivation used the right password against the right server. Server compromise leaks nothing offline-crackable without the separate oprf_seed, and even then each guess costs a full OPRF + KSF evaluation. Deterministic-core convention (per the VOPRF KAT precedent): the *_det functions take ALL randomness (envelope_nonce) as inputs so the RFC C.1.5/C.1.6 vectors can drive them byte-exact; the non-det wrapper draws CSPRNG. KATs gate the _det core; production calls the wrapper. COMPOSES: hub/nx_opaque_core (Expand/DeriveKeyPair/ct_eq), nx_hmac, nx_hkdf, nx_csprng COMPOSED BY: hub/nx_opaque_pake (FinalizeRegistrationRequest / RecoverCredentials) SPEC: RFC 9807 §4.1.2 Store, §4.1.3 Recover, §4 CleartextCredentials license_tier: ORIGINAL