code wiki / _hdl_build / nx_tor_ntor_gate.nx

nx_tor_ntor_gate.nx

buildroot/runtime/_hdl_build/nx_tor_ntor_gate.nx

10739 B128 linesdepth 8pulls 14 transitivereach 0 importersview sourcekind gate/prooftopic tor
docsdependenciesstructsconstsfunctions

about

nx_tor_ntor_gate.nx -- GATE for the sovereign Tor ntor handshake (tor-spec §5.1.4). WHAT THIS PROVES (and what it does NOT): PART A PRIMITIVE KATs, byte-exact vs on-disk RFC vectors (spot-checks copied verbatim from nx_x25519_test.nx's own verified assertions): x25519 RFC 7748 §5.2 + §6.1 base-point; and hmac_sha256 RFC 4231 TC1 (first 8 bytes confirmed by nx_hmac.nx). These anchor ntor's DH + MAC. PART B ntor COMPOSITION correctness: client init derives X == RFC 7748 §6.1 Alice pubkey (pubkey derivation anchored); a full two-sided handshake AGREES (client AUTH verifies + client and server derive identical 92-byte circuit keys); deterministic across reruns. PART C fail-closed negatives: tampered Y / AUTH / onion-key B / ID each make the client REJECT. HONEST BOUNDARY (printed below, not hidden): two-sided agreement proves the ntor CONSTRUCTION (tweaks, concat order, KDF wiring) but a mirrored x25519 bug would agree on both sides -- so it is NOT proof of byte-exact interop with the live Tor network. That needs (1) Tor's own published ntor vector (absent in-tree; zero external calls this run) and (2) the x25519 base-point scalar-pattern fix documented in nx_x25519_test.nx. anon_is_anonymizing() stays 0 until a full circuit works. license_tier: ORIGINAL expect_exit: 0

dependencies 5 imports · 0 importers

nx_syscalls.nx nx_x25519.nx nx_x25519_ephemeral.nx nx_hmac.nx nx_tor_ntor.nx nx_tor_ntor_gate.nx

imports: nx_syscalls.nxnx_x25519.nxnx_x25519_ephemeral.nxnx_hmac.nxnx_tor_ntor.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap g_w sys_write x25519 nx_scratch_save nx_scratch_init sys_mmap ↻ nx_scratch nx_scratch_init ↻ nx_scratch_oom sys_write ↻ sys_exit sys_mmap ↻ fe_alloc nx_scratch ↻ fe_from_bytes fe_one fe_zero fe_zero ↻ fe_copy x25519_ladder_step fe_cswap nx_scratch_save ↻ fe_alloc ↻ fe_add fe_sq fe_mul fe_sub fe_mul ↻ fe_mul_a24 nx_scratch_save ↻ fe_alloc ↻ fe_mul ↻ nx_scratch_restore nx_scratch_restore ↻ fe_cswap ↻ fe_invert nx_scratch_save ↻ fe_alloc ↻

structs

none

consts

none

functions

21func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 3: g_ng_rowmain calls 1: sys_write
22func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let o:*u8=sys_mmap(24); var i:i64=0; while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
called by 1: main calls 3: g_wsys_mmapsys_write
23func g_fw(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
called by 1: main calls 1: sys_write
24func g_fn(fd: i64, v: i64) -> i64 { var m: i64=v; let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let o:*u8=sys_mmap(24); var i:i64=0; while i<k{o[i]=t[k-1-i];i=i+1} sys_write(fd,o,k); return 0 }
called by 1: main calls 2: sys_mmapsys_write
25func g_row(id: *u8, ok: i64, pass: *i64, tot: *i64) -> i64 { tot[0]=tot[0]+1; g_w(" " as *u8); g_w(id); if ok==1 { g_w(": OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w(": FAIL\n" as *u8) } return 0 }
called by 1: main calls 1: g_w
26func g_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
called by 1: main
28func main() -> i64
calls 18: sys_mmapg_wx25519g_rowx25519_base_pointhmac_sha256+12