nx_ssh_kex.nx

buildroot/runtime/nx_ssh_kex.nx

9952 B232 linesdepth 9pulls 17 transitivereach 0 importersview sourcekind tooltopic ssh

docs dependencies structs consts functions

about

nx_ssh_kex.nx -- sovereign SSH-2 key exchange (phase 1 of the bits-up SSH client). Implements the ONE ciphersuite the NAS prefers (verified by nx_ssh_probe): curve25519-sha256 KEX + ssh-ed25519 host key. Performs the full client KEX against a real OpenSSH server and VERIFIES the server's Ed25519 signature over our independently-computed exchange hash H. If that signature verifies, every byte was right: our version string, our KEXINIT (I_C), the server KEXINIT we captured (I_S), the X25519 shared secret K, and the RFC-8731 exchange-hash construction. That is a 1:1 interop proof against the real server -- not a self-test. H = SHA256( string(V_C) || string(V_S) || string(I_C) || string(I_S) || string(K_S) || string(Q_C) || string(Q_S) || mpint(K) ) Bits-up: raw syscalls + our own X25519/Ed25519/SHA-256. No openssh/libssl. license_tier: ORIGINAL

dependencies 5 imports · 0 importers

imports: nx_syscalls.nxnx_connect.nxnx_x25519_ephemeral.nxnx_ed25519_signature.nxnx_sha256.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

24	const K_MAGIC_4096: i64 = 4096
25	const K_MAGIC_1024: i64 = 1024

functions

27	func P(s: *u8, n: i64) -> i64 { sys_write(1, s, n); return 0 } called by 1: main calls 1: sys_write
28	func phex(b: *u8, n: i64) -> i64 called by 1: main calls 2: sys_mmap sys_write
39	func ssh_sockaddr(sa: *u8, ip: i64, port: i64) -> i64 called by 1: main
48	func u32be(b: *u8, off: i64) -> i64 called by 2: read_packet main
51	func read_full(fd: i64, dst: *u8, n: i64) -> i64 called by 1: read_packet calls 1: sys_read
61	func read_line(fd: i64, dst: *u8, max: i64) -> i64 called by 1: main calls 1: sys_read
72	func put_u32(b: *u8, idx: i64, v: i64) -> i64 called by 4: put_str send_packet h_u32 main
77	func put_byte(b: *u8, idx: i64, v: i64) -> i64 { b[idx] = (v & 0xff) as u8; return idx + 1 } called by 1: main
78	func put_bytes(b: u8, idx: i64, s: u8, n: i64) -> i64 called by 4: put_str send_packet read_packet main
83	func put_str(b: u8, idx: i64, s: u8, n: i64) -> i64 called by 1: main calls 2: put_u32 put_bytes
88	func send_packet(fd: i64, payload: *u8, plen: i64) -> i64 called by 1: main calls 4: sys_mmap put_u32 put_bytes sys_write
101	func read_packet(fd: i64, payload_out: *u8) -> i64 called by 1: main calls 4: sys_mmap read_full u32be put_bytes
113	func h_u32(ctx: *Sha256, v: i64) -> i64 called by 1: h_str calls 3: sys_mmap put_u32 sha256_update
116	func h_str(ctx: Sha256, src: u8, n: i64) -> i64 { h_u32(ctx, n); sha256_update(ctx, src, n); return 0 } called by 1: main calls 2: h_u32 sha256_update
119	func build_mpint(K: u8, n: i64, out: u8) -> i64 called by 1: main
129	func main() -> i64 calls 23: sys_socket P sys_mmap ssh_sockaddr nx_connect_bounded sys_write+17