nx_cmos_signed_gate.nx source

1// nx_cmos_signed_gate.nx -- proves authenticated CMOS config recovery. 2// 3// T0 golden-capsule-verifies : a platform-signed CMOS golden capsule verifies 4// T1 restore-authentic : restoring from the signed golden recovers a checksum-valid CMOS 5// N1 tampered-golden-refused : a byte-tampered golden capsule -> restore REFUSED (signature fails) 6// N2 forged-golden-refused : a golden signed by a DIFFERENT key -> restore REFUSED 7// N3 signed-but-invalid-refused: a validly-signed capsule whose payload is a BAD CMOS -> REFUSED (defense-in-depth) 8// 9// GREEN only if all five hold. ed25519 signs minimized. Evidence -> knowledge/status/cmos_signed_gate.log. 10// Sovereign: imports nx_cmos_signed (-> nx_cmos + nx_fw_capsule -> nx_ed25519) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL 11import "nx_cmos_signed.nx" 12import "nx_framed_append.nx" 13import "nx_syscalls.nx" 14 15const CSG_LOG: *u8 = "knowledge/status/cmos_signed_gate.log" 16 17func cs_copy(src: *u8, dst: *u8) -> i64 { 18 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 19 let b: *u8 = cp_read(src, lb) 20 if (b as i64) == 0 { return 0 - 1 } 21 cp_write(dst, b, lb[0]) 22 return 0 23} 24func csg_row(name: *u8, pass: i64) -> i64 { 25 let buf: *u8 = sys_mmap(528) 26 var o: i64 = 0 27 o = cp_cat(buf, o, "CMSG row=\x00" as *u8) 28 o = cp_cat(buf, o, name) 29 if pass == 1 { o = cp_cat(buf, o, " verdict=PASS\x00" as *u8) } else { o = cp_cat(buf, o, " verdict=FAIL\x00" as *u8) } 30 buf[o] = 0 as u8 31 fa_appendz(CSG_LOG, buf, 512) 32 c_puts(" "); c_puts(name) 33 if pass == 1 { c_puts(" PASS\n") } else { c_puts(" FAIL\n") } 34 return 0 35} 36 37func main() -> i64 { 38 c_puts("cmos-signed gate (authenticated config recovery)\n") 39 let e: i64 = sys_now_realtime_sec() 40 let p: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 41 let plat: *u8 = sys_mmap(32); cap_plat_seed(plat) 42 let forged: *u8 = sys_mmap(32); var i: i64 = 0; while i < 32 { forged[i] = ((i * 3 + 99) & 0xff) as u8; i = i + 1 } 43 let img: *u8 = sys_mmap(CMOS_SIZE + 16); cmos_golden(img) 44 let bad: *u8 = sys_mmap(CMOS_SIZE + 16); cmos_golden(bad); cmos_corrupt_raw(bad, 20) // signed-but-invalid CMOS 45 let work: *u8 = sys_mmap(CMOS_SIZE + 16) 46 47 let gcap: *u8 = sys_mmap(256); cap_path(gcap, "/tmp/cmsg_g." as *u8, e, p); cmos_golden_capsule(gcap, img, plat) 48 let fcap: *u8 = sys_mmap(256); cap_path(fcap, "/tmp/cmsg_f." as *u8, e, p); cmos_golden_capsule(fcap, img, forged) 49 let bcap: *u8 = sys_mmap(256); cap_path(bcap, "/tmp/cmsg_b." as *u8, e, p); cmos_golden_capsule(bcap, bad, plat) 50 let tcap: *u8 = sys_mmap(256); cap_path(tcap, "/tmp/cmsg_t." as *u8, e, p); cs_copy(gcap, tcap); cap_corrupt(tcap) 51 52 // T0 golden capsule verifies 53 var t0: i64 = 0; if cap_verify(gcap) == 1 { t0 = 1 } 54 55 // T1 restore from authentic golden recovers a valid CMOS 56 cmos_golden(work); cmos_corrupt_raw(work, 20) 57 let r1: i64 = cmos_restore_signed(work, gcap) 58 var t1: i64 = 0; if r1 == 0 { if cmos_valid(work) == 1 { t1 = 1 } } 59 60 // N1 tampered golden refused (and working left untouched/invalid) 61 cmos_golden(work); cmos_corrupt_raw(work, 20) 62 let r2: i64 = cmos_restore_signed(work, tcap) 63 var n1: i64 = 0; if r2 == CS_REFUSED { if cmos_valid(work) == 0 { n1 = 1 } } 64 65 // N2 forged golden refused 66 cmos_golden(work); cmos_corrupt_raw(work, 20) 67 let r3: i64 = cmos_restore_signed(work, fcap) 68 var n2: i64 = 0; if r3 == CS_REFUSED { n2 = 1 } 69 70 // N3 signed-but-invalid-CMOS refused (defense in depth: signature OK, but bad config) 71 var n3: i64 = 0 72 if cap_verify(bcap) == 1 { if cmos_restore_signed(work, bcap) == CS_REFUSED { n3 = 1 } } 73 74 var passes: i64 = 0 75 if t0 == 1 { passes = passes + 1 } 76 if t1 == 1 { passes = passes + 1 } 77 if n1 == 1 { passes = passes + 1 } 78 if n2 == 1 { passes = passes + 1 } 79 if n3 == 1 { passes = passes + 1 } 80 var green: i64 = 0 81 if passes == 5 { green = 1 } 82 83 csg_row("T0-golden-capsule-verifies\x00" as *u8, t0) 84 csg_row("T1-restore-authentic-valid\x00" as *u8, t1) 85 csg_row("N1-tampered-golden-refused\x00" as *u8, n1) 86 csg_row("N2-forged-golden-refused \x00" as *u8, n2) 87 csg_row("N3-signed-bad-cmos-refused\x00" as *u8, n3) 88 89 let vb: *u8 = sys_mmap(528) 90 var o: i64 = 0 91 o = cp_cat(vb, o, "CMOS-SIGNED verdict=\x00" as *u8) 92 if green == 1 { o = cp_cat(vb, o, "GREEN\x00" as *u8) } else { o = cp_cat(vb, o, "RED\x00" as *u8) } 93 o = cp_cat(vb, o, " passes=\x00" as *u8); o = cp_catn(vb, o, passes); o = cp_cat(vb, o, "/5 END\x00" as *u8) 94 vb[o] = 0 as u8 95 fa_appendz(CSG_LOG, vb, 512) 96 c_puts(vb); c_puts("\n") 97 98 if green == 1 { return 0 } 99 return 1 100}