code wiki / _hdl_build / nx_opaque_login_tls_daemon.nx
nx_opaque_login_tls_daemon.nx
buildroot/runtime/_hdl_build/nx_opaque_login_tls_daemon.nx
about
nx_opaque_login_tls_daemon.nx -- R3-B: the no-cookie OPAQUE login served over SOVEREIGN TLS 1.3 (ECDSA
P-256, browser-trusted with the LE cert) on the real domain. Same route table as the plain daemon
(nx_opaque_login_routes.olg_route -- rule 15 DRY), wrapped per-connection in the team's own TLS stack:
nx_tls13_server_session_run (ECDSA) -> app_recv (decrypt) -> olg_route -> app_send (encrypt) -> write.
argv: [1]=port [2]=keys-path [3]=store-path [4]=budget [5]=cert.der [6]=ecdsa_key.bin(32B) [7]=argon2_m (opt).
Fresh server ECDHE + ServerHello random PER CONNECTION (forward secrecy). No shortcuts: full OPAQUE +
real TLS 1.3 + production argon2id default.
dependencies 5 imports · 0 importers
imports: nx_opaque_login_routes.nxnx_tls13_server_session.nxnx_tls13_server_session_run.nxnx_tls13_server_session_app_data.nxnx_csprng.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 14 | const OLT_PROD_M: i64 = 65536 // production argon2id m_cost (64 MiB) |
functions
| 16 | func olt_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; while s[i]!=(0 as u8){ let c: i64=s[i] as i64; if c<48{return v} if c>57{return v} v=v*10+(c-48); i=i+1 } return v } called by 1: main |
| 18 | func main(argc: i64, argv: *i64) -> i64 |