nx_pkcs12_kdf.nx

buildroot/runtime/nx_pkcs12_kdf.nx

6936 B143 linesdepth 6pulls 6 transitivereach 3 importersview sourcekind tool

docs dependencies structs consts functions

about

nx_pkcs12_kdf.nx -- the PKCS#12 password-based KDF (RFC 7292 Appendix B.2) over SHA-256. The KDF PKCS#12 uses for BOTH its PBE encryption keys/IVs (id=1 key, id=2 IV) AND its integrity MAC key (id=3). Needed by the .p12 provisioning rung R5b so a browser/OS (Windows cert store, Chrome/Edge/Firefox) accepts the imported client identity -- the MAC + key derivation MUST be byte-exact or the import is rejected. SHA-256 variant: u=32 (hash out), v=64 (hash block). Password is a BMPString (UTF-16BE + a two-byte NUL terminator) per RFC 7292 App B.1. Composes sha256 (one-shot digest). GATE (main): KAT vs reference values computed independently (RFC 7292 B.2 reference impl); the FINAL .p12 is then validated end-to-end by `openssl pkcs12` (the authoritative oracle, dev-time only -- not shipped). license_tier: ORIGINAL expect_exit: 0 module: nishi-core.crypto.pkcs12_kdf

dependencies 2 imports · 1 importers

imports: nx_syscalls.nxsha256.nx

imported by: nx_mtls_pkcs12.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const P12_MAGIC_2048: i64 = 2048
16	const P12_U: i64 = 32 // SHA-256 output bytes
17	const P12_V: i64 = 64 // SHA-256 block bytes

functions

20	func p12_bnadd_v(dst: u8, b: u8) -> i64 called by 1: nx_pkcs12_kdf
33	func p12_fill(data: u8, dlen: i64, v: i64, out: u8) -> i64 called by 1: nx_pkcs12_kdf
44	func nx_pkcs12_kdf(pw_bmp: u8, pw_n: i64, salt: u8, salt_n: i64, iter: i64, idb: i64, n: i64, out: *u8) -> i64 called by 2: nx_mtls_emit_pkcs12_from main calls 3: sys_mmap p12_fill p12_bnadd_v
91	func nx_pkcs12_bmp_password(ascii: u8, n: i64, out: u8) -> i64 called by 2: nx_mtls_emit_pkcs12_from main
99	func kd_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } called by 2: kd_row main calls 1: sys_write
100	func kd_hexv(c: i64) -> i64 { if c>=48 { if c<=57 { return c-48 } } if c>=97 { if c<=102 { return c-97+10 } } return 0 } called by 1: kd_hex2bin
101	func kd_hex2bin(hex: u8, out: u8, nb: i64) -> i64 { var i: i64 = 0; while i < nb { out[i] = ((kd_hexv(hex[i2] as i64)<<4)\|kd_hexv(hex[i2+1] as i64)) & 0xff; i = i + 1 } return nb } called by 1: main calls 1: kd_hexv
102	func kd_eq(a: u8, b: u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if (a[i] & 0xff) != (b[i] & 0xff) { return 0 } i = i + 1 } return 1 } called by 1: main
103	func kd_row(name: u8, ok: i64) -> i64 { if ok == 1 { kd_puts(" PASS " as u8) } else { kd_puts(" FAIL " as u8) } kd_puts(name); kd_puts("\n" as u8); return ok } called by 1: main calls 1: kd_puts
105	func main() -> i64 calls 8: kd_puts sys_mmap nx_pkcs12_bmp_password kd_hex2bin kd_eq kd_row+2