nx_x509_pubkey_alg.nx
buildroot/runtime/nx_x509_pubkey_alg.nx
about
nx_x509_pubkey_alg.nx -- identify the public-key algorithm of a
SubjectPublicKeyInfo by inspecting its AlgorithmIdentifier bytes.
Phase 0b §I.4 piece 4 of the chain-walker arc. Parallel to
nx_x509_sig_alg.nx (046d5dae) but reads from cert.pubkey_alg_off/_len
instead of cert.sig_alg_off/_len.
Sealed enum:
NX_X509_PUBKEY_ALG_UNKNOWN (0) unrecognized / unsupported
NX_X509_PUBKEY_ALG_ED25519 (1) OID 1.3.101.112 (RFC 8410)
DER inner: 06 03 2B 65 70
NX_X509_PUBKEY_ALG_EC_P256 (2) OID 1.2.840.10045.2.1 (id-ecPublicKey)
with namedCurve OID 1.2.840.10045.3.1.7
(prime256v1)
For EC pubkeys we MUST peek at the second OID (the namedCurve)
to distinguish P-256 from P-384 etc. Just checking
id-ecPublicKey would let a P-384 pubkey be mis-identified as
P-256, causing extract_ec_p256 to fail later with confusing
"BAD_LEN" rather than the precise "wrong curve" diagnosis.
Per Cardinals 9 (single-responsibility -- identify, not extract),
12 (defensive at boundaries -- bounded reads), and 23 (preamble
explains the namedCurve peek + why it matters).
Public API:
nx_x509_pubkey_alg_identify(buf, off, len) -> alg-enum
nx_x509_pubkey_alg_is_supported(alg) -> 0|1
license_tier: INDEPENDENT_REDERIVE
genealogy_id: international-research-sources/ietf/rfc_5280 + rfc_5480 +
ietf/rfc_8410 + sec_g/sec2_v1
lineage_id: nishi_x509_pubkey_alg_q10
dependencies 2 imports · 4 importers
imports: nx_syscalls.nxnx_asn1.nx
imported by: nx_tls13_recv_hs_probe_test.nxnx_x509_pubkey_alg_test.nxnx_x509_verify_under_issuer.nxnx_x509_verify_under_issuer_test.nx
structs
| none |
consts
| 44 | const NX_X509_PUBKEY_ALG_UNKNOWN: i64 = 0 |
| 45 | const NX_X509_PUBKEY_ALG_ED25519: i64 = 1 |
| 46 | const NX_X509_PUBKEY_ALG_EC_P256: i64 = 2 |
| 47 | const NX_X509_PUBKEY_ALG_EC_P384: i64 = 3 |
| 52 | const NX_X509_PUBKEY_ALG_RSA: i64 = 4 |
| 53 | const NX_X509_PUBKEY_ALG_N: i64 = 5 |
functions
| 55 | func nx_x509_pubkey_alg_is_supported(alg: i64) -> i64 |
| 63 | func oid_is_id_ec_public_key(buf: *u8, off: i64, len: i64) -> i64 called by 1: nx_x509_pubkey_alg_identify |
| 77 | func oid_is_prime256v1(buf: *u8, off: i64, len: i64) -> i64 called by 1: nx_x509_pubkey_alg_identify |
| 92 | func oid_is_secp384r1(buf: *u8, off: i64, len: i64) -> i64 called by 1: nx_x509_pubkey_alg_identify |
| 104 | func oid_is_rsa_encryption(buf: *u8, off: i64, len: i64) -> i64 called by 1: nx_x509_pubkey_alg_identify |
| 120 | func oid_is_ed25519(buf: *u8, off: i64, len: i64) -> i64 called by 1: nx_x509_pubkey_alg_identify |
| 131 | func nx_x509_pubkey_alg_identify(buf: *u8, off: i64, len: i64) -> i64 |
| 185 | func main() -> i64 |