code wiki / _hdl_build / nx_p384_ecdh_gate.nx
nx_p384_ecdh_gate.nx
buildroot/runtime/_hdl_build/nx_p384_ecdh_gate.nx
about
nx_p384_ecdh_gate.nx -- KAT for the P-384 ECDHE curve math against RFC 5903 section 8.2.
WHY: nx_p384_ecdh.nx was built + DEPLOYED LIVE on the TLS client (triple key_share x25519+P256+P384)
but was BEHAVIORALLY UNPROVEN -- no TLS 1.3 server this stack talks to has ever picked secp384r1
(they all prefer x25519), so the curve code has never once executed against a known answer. Deployed
and never-exercised is exactly the shape that ships a silent crypto bug: the day a server DOES pick
P-384, a wrong scalar mult is a failed handshake at best. This gate proves the math independent of
any server, using the published IKE/IKEv2 vectors (fetched from rfc-editor.org 2026-07-25, not recalled).
Vectors (RFC 5903 8.2, IANA DH group 20):
i = initiator private (48B) gix/giy = its public point
r = responder private (48B) grx/gry = its public point
girx = shared secret = X(i*g^r) = X(r*g^i) <- proven BOTH directions here
T5 is the discriminating NEGATIVE control: one flipped byte in the peer's X must NOT still agree
(without it a stubbed/constant shared-secret path would pass T3/T4 vacuously).
D001: emits a `verdict=` anchor. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnx_p384_ecdh.nxnx_gate_lib.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 20 | const PKG_BUF: i64 = 8192 |
| 21 | const PKG_EXIT_RED: i64 = 1 |
functions
| 25 | func pkg_puts(s: *u8) -> i64 { return gl_puts(s) } |
| 26 | func pkg_putn(v: i64) -> i64 { return gl_putn(v) } |
| 27 | func pkg_hexv(c: i64) -> i64 called by 1: pkg_unhex |
| 33 | func pkg_unhex(s: *u8, out: *u8) -> i64 |
| 48 | func pkg_eq(a: *u8, b: *u8, n: i64) -> i64 called by 1: main |
| 54 | func pkg_check(nm: *u8, ok: i64, counts: *i64) -> i64 { return gl_check(nm, ok, counts) } |
| 56 | func main() -> i64 |