nx_auth_research.nx source

1// nx_auth_research.nx -- THIN structured AUTHENTICATION-SOTA research organ. COMPOSES nx_research_engine 2// (sovereign TLS-1.3 fetch -> strip -> bank). Operator 2026-07-05: "make sure we are using the opaque or 3// whatever else is state of the art and that its the unified approach across all our nishi systems use the 4// nishi researcher and systems." Per [[feedback-research-honestly-not-just-memory-toss]] + 5// [[feedback-researcher-depth-is-dynamic-not-hardcoded]]: PRIMARY sources (IETF RFCs + W3C spec), NOT 6// wikipedia toss. Grounds the question "is OPAQUE-3DH/RFC9807 + Argon2id still SOTA, and what is the 7// passwordless frontier (passkeys/WebAuthn)?" so nx_auth_unification_census grades against sourced truth. 8// Banks clean .txt -> knowledge/library/ (indexed by nx_library_harvest_v2, queried by nx_search_cli). 9// license_tier: ORIGINAL 10import "nx_research_engine.nx" 11const K_MAGIC_8388608: i64 = 8388608 12 13func main() -> i64 { 14 let store: *TrustStore = rf_init() 15 if (store as i64) == 0 { rf_puts("auth: trust store load failed\n" as *u8); return 1 } 16 rf_puts("CA roots="); rf_putn(trust_store_count(store)); rf_puts(" -- AUTH SOTA research (aPAKE / KDF / sessions / passwordless) -> Library\n" as *u8) 17 let cap: i64 = K_MAGIC_8388608 18 let out: *u8 = sys_mmap(cap) 19 var ok: i64 = 0 20 21 // The augmented-PAKE core: OPAQUE is what we run. SRP = the legacy aPAKE it supersedes; CPace = the 22 // CFRG-selected BALANCED PAKE (different threat model -- both parties know the password); the CFRG 23 // selection writeup is the authoritative "why OPAQUE for the augmented case" record. 24 rf_section("AUGMENTED PAKE (the aPAKE core -- what a password login MUST be in 2026)" as *u8) 25 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc9807.txt" as *u8, "auth_rfc9807_opaque" as *u8, store, out, cap) 26 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc2945.txt" as *u8, "auth_rfc2945_srp_legacy" as *u8, store, out, cap) 27 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc9382.txt" as *u8, "auth_rfc9382_spake2" as *u8, store, out, cap) 28 ok = ok + rf_fetch_bank("https://datatracker.ietf.org/doc/draft-irtf-cfrg-cpace/" as *u8, "auth_cpace_balanced" as *u8, store, out, cap) 29 30 // The OPRF OPAQUE is built on (RFC 9497) + the password-hardening KDF (Argon2id RFC 9106) vs the 31 // legacy KDFs we must NOT regress to (PBKDF2 RFC 8018, scrypt RFC 7914). 32 rf_section("OPRF + PASSWORD-HARDENING KDF (memory-hard is the 2026 floor)" as *u8) 33 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc9497.txt" as *u8, "auth_rfc9497_oprf" as *u8, store, out, cap) 34 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc9106.txt" as *u8, "auth_rfc9106_argon2" as *u8, store, out, cap) 35 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc7914.txt" as *u8, "auth_rfc7914_scrypt" as *u8, store, out, cap) 36 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc8018.txt" as *u8, "auth_rfc8018_pbkdf2_legacy" as *u8, store, out, cap) 37 38 // Sessions/tokens: our no-cookie Ed25519 bearer vs the industry tokens (JWT RFC 7519 + its pitfalls, 39 // PASETO as the hardened answer). Grounds "is a signed bearer token the right session primitive?" 40 rf_section("SESSIONS / BEARER TOKENS (our no-cookie signed session vs JWT/PASETO)" as *u8) 41 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc7519.txt" as *u8, "auth_rfc7519_jwt" as *u8, store, out, cap) 42 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc8032.txt" as *u8, "auth_rfc8032_ed25519" as *u8, store, out, cap) 43 ok = ok + rf_fetch_bank("https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/" as *u8, "auth_oauth21" as *u8, store, out, cap) 44 45 // The passwordless frontier: WebAuthn/passkeys (W3C) + FIDO2. The HONEST SOTA gap -- a password 46 // aPAKE is best-in-class FOR PASSWORDS, but passkeys are the direction of travel. Census flags it. 47 rf_section("PASSWORDLESS FRONTIER (passkeys / WebAuthn / FIDO2 -- the direction of travel)" as *u8) 48 ok = ok + rf_fetch_bank("https://www.w3.org/TR/webauthn-3/" as *u8, "auth_webauthn_l3" as *u8, store, out, cap) 49 ok = ok + rf_fetch_bank("https://www.rfc-editor.org/rfc/rfc6238.txt" as *u8, "auth_rfc6238_totp" as *u8, store, out, cap) 50 51 rf_puts("AUTH SOTA BANKED: "); rf_putn(ok); rf_puts(" / 13 (primary RFCs+W3C, sections preserved, gzip-guarded; nx_library_harvest_v2 to index, nx_search_cli to query)\n" as *u8) 52 if ok < 1 { return 51 } 53 return 0 54}