nx_x509_dn_match.nx

nx_x509_dn_match.nx -- byte-equality comparison of two X.509 Distinguished Names (DER-encoded Name SEQUENCEs). Phase 0b §I.4 piece 6 of the chain-walker arc. Composes the X509Cert.issuer_off/_len and X509Cert.subject_off/_len captured by x509_parse with simple byte-equality to enable issuer -> subject DN matching in the chain walker. Algorithm: RFC 5280 §7.1 says DN comparison MAY use the lexical equality of DER encodings as a conservative match. Real CAs emit byte-equal issuer DN (in child cert) and subject DN (in parent cert) for chains they intend to be walkable, so byte- equality covers ~all real Web PKI. Edge cases (case-folding, PrintableString-vs-UTF8 normalisation) are deliberately out of scope for this primitive -- if a real chain fails to match byte-exact, the caller (chain walker) returns DN_MISMATCH and the operator investigates. This matches BoringSSL's default behavior for "strict" mode. Public API: nx_x509_dn_match(buf_a, off_a, len_a, buf_b, off_b, len_b) -> 1 if byte-equal, 0 if different Per Cardinals 9 (single-responsibility -- just compare; chain orchestration is separate), 12 (defensive at boundaries -- length check first), and 23 (preamble explains why byte-equality is the conservative-but-sufficient strategy). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_5280 lineage_id: nishi_x509_dn_match_q10