nx_x509_verify_under_issuer.nx -- per-cert outer-signature verify
against an issuer's pubkey, dispatching by sig_alg + pubkey_alg.
Phase 0b §I.4 piece 5 of the chain-walker arc. This is the
per-cert step the chain walker repeats from leaf to root:
for each (cert, issuer) pair in the chain:
nx_x509_verify_under_issuer(buf, cert, issuer_buf, issuer_cert)
Dispatch:
1. Identify cert's outer sig_alg from cert.sig_alg_off/_len
2. Identify issuer's pubkey_alg from issuer.pubkey_alg_off/_len
3. Assert the sig_alg and pubkey_alg pair is consistent (e.g.,
ECDSA-P256-SHA-256 sig requires EC-P256 pubkey).
4. Extract issuer's pubkey via the alg-specific extractor.
5. Verify cert.tbs's outer sig under that pubkey via the
alg-specific verifier.
Composes 6 substrate primitives:
nx_x509_sig_alg.nx (sig_alg OID identify)
nx_x509_pubkey_alg.nx (pubkey_alg OID identify)
nx_x509_pubkey_ec.nx (extract EC P-256 X, Y)
nx_x509_pubkey_ed.nx (extract Ed25519 32-byte key)
nx_x509_verify_ecdsa.nx (verify ECDSA-P256+SHA-256)
nx_x509_validate.nx (verify Ed25519 raw sig)
Sealed verdict enum (one for the whole pipeline):
NX_X509_VUI_OK verify succeeded
NX_X509_VUI_SIG_ALG_UNSUPPORTED cert sig_alg not recognized
NX_X509_VUI_PUB_ALG_UNSUPPORTED issuer pubkey_alg not recognized
NX_X509_VUI_ALG_MISMATCH sig_alg requires different pubkey alg
NX_X509_VUI_PUBKEY_EXTRACT_FAIL pubkey extractor returned non-OK
NX_X509_VUI_VERIFY_FAIL verifier returned non-OK
Per Cardinals 9 (single-responsibility -- this is JUST dispatch +
orchestration; each step has its own primitive), 12 (defensive
at boundaries -- algorithm pairing check is the boundary), 22
(composition -- 6 primitives compose), 23 (preamble names every
dispatch case).
license_tier: INDEPENDENT_REDERIVE
dependencies 20 imports · 7 importers
diagram shows first 10 each side; +10 more imports, +0 more importers in the complete lists below.