nx_tls12_record_gcm_gate.nx

nx_tls12_record_gcm_gate.nx -- SOVEREIGN gate for the TLS 1.2 AES-128-GCM record layer (RFC 5246 §6.2.3.3 + RFC 5288), validating the shipped nx_tls12_record.nx organ (tls12_record_seal / tls12_record_open) and the AES-128-GCM AEAD it composes (nx_aes128_gcm.nx). NOTE on organ name: the task brief calls the organ nx_tls12_record_gcm.nx; the equivalent organ already shipped as nx_tls12_record.nx (verify-don't- rebuild, no duplicate crypto). This gate targets that existing organ. ---- PUBLISHED KAT: AES-128-GCM "Test Case 4" ---- Source: McGrew & Viega, "The Galois/Counter Mode of Operation (GCM)", Appendix B, Test Case 4 -- the reference test set adopted by NIST SP 800-38D. Reproduced byte-identically across openssl/ruby-openssl/etc. K = feffe9928665731c6d6a8f9467308308 (16) IV= cafebabefacedbaddecaf888 (12) A = feedfacedeadbeeffeedfacedeadbeefabaddad2 (20) P = d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318 a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39 (60) C = 42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329ac a12e21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091 (60) T = 5bc94fbc3221a5db94fae95ae7121a47 (16) This proves the AEAD primitive the record layer composes, byte-exact, with a non-empty AAD and a non-block-aligned (60-byte) plaintext. ---- TLS 1.2 record framing (the organ's own logic) ---- CRITICAL: TLS 1.2's AAD DIFFERS from TLS 1.3's. Here nonce(12) = salt(4, implicit from key_block) || explicit_nonce(8, on wire) AAD(13) = seq_num(8) || type(1) || version(2=0x0303) || plaintext_len(2) record = explicit_nonce(8) || ciphertext || tag(16) Proven by: exact 13-byte AAD layout (RFC 5246 §6.2.3.3), exact nonce split, composition vs the published AEAD, full seal->open round-trip, a tampered tag (open MUST fail, constant-time compare in nx_aes128_gcm_tag_eq), and an AAD-binding check (open under the wrong seq MUST fail). expect_exit: 0 license_tier: ORIGINAL