code wiki / _hdl_build / nx_x25519_kat_gate.nx

nx_x25519_kat_gate.nx

buildroot/runtime/_hdl_build/nx_x25519_kat_gate.nx

10940 B111 linesdepth 5pulls 6 transitivereach 0 importersview sourcekind gate/prooftopic x25519
docsdependenciesstructsconstsfunctions

about

nx_x25519_kat_gate.nx -- RIGOROUS standing KAT for X25519 (RFC 7748). Supersedes the compile-only smoke in nx_x25519_test.nx. Proves the shared primitive (TLS 1.3 + ntor + browser arc depend on it) is correct across a huge input space, and RESOLVES the misdiagnosed 'base-point bug': the impl is correct; the old expected value 99381de5.. (from RFC 8448 3, whose ephemeral x25519 triple is internally inconsistent -- its ECDHE 8bd4054f.. is ALSO wrong per OpenSSL, true value fab1d4c6..) was the error. Correct value X25519(49af,9)=88fd30ab.. is asserted here. T1 RFC 7748 5.2 test-1 T2 5.2 test-2 T3 6.1 base-point Alice T4 6.1 base-point Bob T5 6.1 DH golden dir1 == K T6 6.1 DH golden dir2 == K T7 DH commutes (dir1==dir2, needs no oracle) T8 5.2 iterated x1 == golden T9 5.2 iterated x1000 == golden (the canonical acceptance KAT) T10 X25519(49af,spub)==fab1d4c6 (OpenSSL-verified) T11 X25519(49af,9)==88fd30ab (CORRECTED base-point value) license_tier: ORIGINAL expect_exit: 0

dependencies 3 imports · 0 importers

nx_syscalls.nx nx_x25519.nx nx_x25519_ephemeral.nx nx_x25519_kat_gate.nx

imports: nx_syscalls.nxnx_x25519.nxnx_x25519_ephemeral.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap g_w sys_write x25519_base_point x25519 nx_scratch_save nx_scratch_init sys_mmap ↻ nx_scratch nx_scratch_init ↻ nx_scratch_oom sys_write ↻ sys_exit sys_mmap ↻ fe_alloc nx_scratch ↻ fe_from_bytes fe_one fe_zero fe_zero ↻ fe_copy x25519_ladder_step fe_cswap nx_scratch_save ↻ fe_alloc ↻ fe_add fe_sq fe_mul fe_sub fe_mul ↻ fe_mul_a24 nx_scratch_save ↻ fe_alloc ↻ fe_mul ↻ nx_scratch_restore nx_scratch_restore ↻ fe_cswap ↻ fe_invert nx_scratch_save ↻

structs

none

consts

none

functions

17func g_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
called by 3: g_ng_rowmain calls 1: sys_write
18func g_n(v: i64) -> i64 { var m: i64=v; if m<0{g_w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let o:*u8=sys_mmap(24); var i:i64=0; while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 }
called by 1: main calls 3: g_wsys_mmapsys_write
19func g_fw(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
called by 1: main calls 1: sys_write
20func g_fn(fd: i64, v: i64) -> i64 { var m: i64=v; let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} let o:*u8=sys_mmap(24); var i:i64=0; while i<k{o[i]=t[k-1-i];i=i+1} sys_write(fd,o,k); return 0 }
called by 1: main calls 2: sys_mmapsys_write
21func g_row(id: *u8, ok: i64, pass: *i64, tot: *i64) -> i64 { tot[0]=tot[0]+1; g_w(" " as *u8); g_w(id); if ok==1 { g_w(": OK\n" as *u8); pass[0]=pass[0]+1 } else { g_w(": FAIL\n" as *u8) } return 0 }
called by 1: main calls 1: g_w
22func g_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
called by 1: main
24func main() -> i64
calls 13: sys_mmapg_wx25519_base_pointx25519g_rowg_eq+7