code wiki / _hdl_build / nx_vault_transit.nx
nx_vault_transit.nx
buildroot/runtime/_hdl_build/nx_vault_transit.nx
about
nx_vault_transit.nx -- sovereign TRANSIT engine (encryption-as-a-service): the HashiCorp Vault "transit"
gap from vault_capability_census.tsv. The vault holds the KEY; the caller's data passes THROUGH and is
NEVER stored. Versioned keyring: encrypt stamps the LATEST key version into a self-describing envelope;
decrypt ROUTES to the version named in the envelope (so old ciphertext still opens after key rotation);
rewrap re-encrypts an old-version envelope to the latest version WITHOUT returning plaintext to the caller
(rotate keys without re-exposing the data). REAL AES-128-GCM (composes nx_aes128_gcm = NIST SP800-38D),
fails-closed on tamper. Production keys are vault-sealed (nx_vault + nx_machine_key); here the keyring is
caller-supplied. license_tier: ORIGINAL
dependencies 2 imports · 2 importers
imports: nx_aes128_gcm.nxnx_syscalls.nx
imported by: nx_vault_suite_test.nxnx_vault_transit_test.nx
structs
| none |
consts
| 11 | const TR_MAGIC_4096: i64 = 4096 |
| 14 | const TR_VER_OFF: i64 = 0 |
| 15 | const TR_IV_OFF: i64 = 1 |
| 16 | const TR_TAG_OFF: i64 = 13 |
| 17 | const TR_CT_OFF: i64 = 29 |
functions
| 20 | func tr_keyptr(keyring: *u8, ver: i64) -> *u8 { return ((keyring as i64) + (ver - 1) * 16) as *u8 } |
| 23 | func tr_encrypt(keyring: *u8, latest_ver: i64, iv12: *u8, pt: *u8, pt_len: i64, env_out: *u8) -> i64 |
| 35 | func tr_decrypt(keyring: *u8, key_count: i64, env: *u8, env_len: i64, pt_out: *u8) -> i64 |
| 52 | func tr_rewrap(keyring: *u8, key_count: i64, latest_ver: i64, env_in: *u8, env_in_len: i64, new_iv12: *u8, env_out: *u8) -> i64 |