nx_pem.nx

pem.nx -- RFC 7468 PEM (Privacy-Enhanced Mail) container parser. PEM is the ASCII-armor wrapper around binary DER content in X.509 certs, PKCS#8 private keys, SSH keys, cryptographic signatures. Format: -----BEGIN <LABEL>----- <base64-encoded DER, line-wrapped at 64 chars> -----END <LABEL>----- Common labels: CERTIFICATE (X.509 public cert) PRIVATE KEY (PKCS#8 envelope, algorithm in ASN.1 inside) PUBLIC KEY (SubjectPublicKeyInfo DER) RSA PRIVATE KEY (PKCS#1; legacy, still used) ENCRYPTED PRIVATE KEY (PKCS#8 with PBKDF2) API: pem_decode(buf, len, out_der, out_cap) -> (label_off, label_len, der_len) Returns DER bytes written to out_der, or negative on error. Caller supplies out_der sized >= 3/4 of base64 input. Invariants: PEM1 Finds the FIRST BEGIN/END block in the input; callers needing multiple blocks (cert chains) iterate by advancing past the previous END line. PEM2 Label must match between BEGIN and END (RFC 7468 §3); mismatch returns a negative error. PEM3 Whitespace inside the base64 body (newlines, spaces) is tolerated and stripped before base64_decode. Other non-alphabet bytes return an error. PEM4 Output buffer bounds-checked; overrun returns negative.