nx_x509_pubkey_ec.nx

nx_x509_pubkey_ec.nx -- extract an uncompressed ECDSA-P256 public key (X, Y) from an X.509 SubjectPublicKeyInfo. Phase 0b §I.4 piece 3 of the chain-walker arc. Composes the X509Cert.pubkey_off/_len fields (populated by x509_parse) with the SEC 1 v2.0 §2.3.3 uncompressed point format: pubkey bytes layout (65 bytes for P-256): byte 0 : 0x04 (uncompressed point indicator) bytes 1..33 : X coordinate (32-byte big-endian) bytes 33..65: Y coordinate (32-byte big-endian) x509_parse strips the BIT STRING's "unused bits" prefix byte, so cert.pubkey_off points directly at the 0x04 indicator and cert.pubkey_len == 65 for a P-256 key. Other formats: - 0x02 / 0x03 = compressed form (Y derived from X via curve equation + parity bit -- NOT supported here; rare in TLS PKI which deprecated compressed forms long ago) - 0x05+ = hybrid forms (deprecated) Public API: nx_x509_pubkey_extract_ec_p256(buf, cert, out_x, out_y) -> verdict nx_x509_pubkey_ec_verdict_is_valid(v) -> 0|1 Sealed verdict: NX_X509_PUBKEY_EC_OK extraction successful NX_X509_PUBKEY_EC_BAD_LEN pubkey_len != 65 NX_X509_PUBKEY_EC_NOT_UNCOMPRESSED leading byte != 0x04 Per Cardinals 9 (single-responsibility -- just extract; on-curve check belongs to ecdsa verify), 12 (defensive at boundaries -- length + format check), 23 (preamble explains the compressed- form deferral). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/sec_g/sec1_v2 + ietf/rfc_5480 lineage_id: nishi_x509_pubkey_ec_p256_q10