nx_x509_verify_ecdsa.nx

nx_x509_verify_ecdsa.nx -- X.509 outer-signature verification for ECDSA-P256-with-SHA-256 signed certs (the dominant Web PKI sig algorithm). Phase 0b §I.4 piece 2 of the chain-walker arc. Composes: - nx_sha256 (sha256_digest -- 256-bit hash of tbs) - nx_ecdsa_sig_der (parse DER sig into r, s) - nx_ecdsa_p256 (verify under issuer's pubkey) into the per-cert verify the chain-walker will call repeatedly: "verify this cert's outer sig against this issuer's pubkey" What this primitive verifies: - SHA-256(tbs_bytes) -> e (the 256-bit message hash) - DER-decode the signature into r, s - Call ecdsa_p256_verify(pub_x, pub_y, e, r, s) What it does NOT verify (caller / chain walker / X.509 leaf-check responsibility): - cert validity period - cert SAN matches hostname - cert sig_alg OID actually IS ecdsa-with-SHA-256 (caller dispatches by sig_alg before calling this primitive) - issuer's pubkey actually matches cert.issuer Subject DN (chain walker resolves issuer first) Public API: nx_x509_verify_ecdsa_p256(tbs, tbs_len, sig_der, sig_len, pub_x, pub_y) -> verdict nx_x509_verify_ecdsa_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_X509_ECDSA_OK sig verifies NX_X509_ECDSA_BAD_SIG_DER DER-decode failed NX_X509_ECDSA_BAD_SIG verify returned BAD_SIG / range fail NX_X509_ECDSA_BAD_PUBKEY pubkey off-curve or infinity NX_X509_ECDSA_INFINITY u1*G + u2*Q = O (corrupt sig) Per Cardinals 9 (single-responsibility -- this primitive is JUST the SHA-256 + parse + verify pipeline; caller selects the algo),