nx_x509_sig_alg.nx

nx_x509_sig_alg.nx -- identify the signature algorithm of an X.509 cert by inspecting its sig_alg AlgorithmIdentifier bytes. Phase 0b §I.4 piece 2 of the chain-walker arc. Composes the X509Cert.sig_alg_off/_len fields (populated by x509_parse) with a sealed-enum identifier so the chain walker can dispatch to the right verifier. AlgorithmIdentifier ASN.1 (RFC 5280 §4.1.1.2): AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } We compare the OID bytes against a small table of known algorithm OIDs. Parameters are ignored for the algs we support (Ed25519 and ECDSA have absent or NULL params). Supported algorithms (sealed enum): NX_X509_SIG_ALG_UNKNOWN unrecognized / unsupported NX_X509_SIG_ALG_ED25519 1.3.101.112 DER OID: 06 03 2B 65 70 NX_X509_SIG_ALG_ECDSA_P256_SHA256 1.2.840.10045.4.3.2 DER OID: 06 08 2A 86 48 CE 3D 04 03 02 Queued (not yet supported): - ecdsa-with-SHA-384 (1.2.840.10045.4.3.3) - sha256WithRSAEncryption (1.2.840.113549.1.1.11) -- needs RSA verify - rsassa-pss (1.2.840.113549.1.1.10) -- needs RSA-PSS verify Public API: nx_x509_sig_alg_identify(buf, sig_alg_off, sig_alg_len) -> alg-enum Returns NX_X509_SIG_ALG_* identifier for the AlgorithmIdentifier starting at buf[sig_alg_off] and spanning sig_alg_len bytes. nx_x509_sig_alg_is_supported(alg) -> 0|1