code wiki / (root) / nx_ecdsa_p384_real_bisect_test.nx
`nx_ecdsa_p384_real_bisect_test.nx` source

↩ module page · 286 lines · 10644 B
1// nx_ecdsa_p384_real_bisect_test.nx -- bisect ECDSA-P384 verify
2// pipeline against the cert2 -> cert3 pair of the real example.com
3// chain to locate the root cause of VUI_VERIFY_FAIL (verdict 6).
4//
5// Steps (each value is compared inline with a golden hex computed
6// off-substrate via Python cryptography):
7//   1. SHA-384(cert2.tbs) -- 48 bytes
8//   2. nx_ecdsa_sig_parse_der_384(cert2.sig) -- r, s (12 LE limbs each)
9//   3. nx_x509_pubkey_extract_ec_p384(cert3) -- pub_x, pub_y
10//
11// All bytes are dumped as hex on stderr so we can `diff` against the
12// Python golden.  The test always exits 0; the smoke checks the
13// printed hex matches expected.
14//
15// expect_exit: 0.
16
17import "nx_syscalls.nx"
18import "nx_u384.nx"
19import "nx_x509.nx"
20import "nx_x509_pubkey_ec.nx"
21import "nx_sha512.nx"
22import "nx_ecdsa_sig_der_384.nx"
23import "nx_ecdsa_sig_der.nx"
24import "nx_ecdsa_p384.nx"
25import "nx_x509_verify_ecdsa_p384.nx"
26import "nx_x509_verify_under_issuer.nx"
27import "nx_u256.nx"
28import "nx_x509_verify_ecdsa.nx"
29import "nx_sha256.nx"
30
31func read_to(path: *u8, out_buf: *u8, max: i64) -> i64 {
  let len_p: *i64 = sys_mmap(16) as *i64
  let p: *u8 = sys_read_file(path, len_p)
  let n: i64 = *len_p
  if n <= 0 { return 0 - 1 }
  if n > max { return 0 - 2 }
  var i: i64 = 0
  while i < n { out_buf[i] = p[i]; i = i + 1 }
  return n
40}
41
42func emit_label(c0: i64, c1: i64, c2: i64, c3: i64, c4: i64) -> i64 {
  let b: *u8 = sys_mmap(8)
  b[0]=c0 as u8; b[1]=c1 as u8; b[2]=c2 as u8; b[3]=c3 as u8
  b[4]=c4 as u8; b[5]=0x3D
  sys_write(2, b, 6)
  return 0
48}
49
50func emit_nl() -> i64 {
  let nl: *u8 = sys_mmap(8); nl[0]=0x0A; sys_write(2, nl, 1)
  return 0
53}
54
55func hexnib(v: i64) -> i64 {
  if v < 10 { return 0x30 + v }
  return 0x61 + (v - 10)
58}
59
60func dump_bytes(bytes: *u8, n: i64) -> i64 {
  let buf: *u8 = sys_mmap(n * 2 + 4)
  var i: i64 = 0
  while i < n {
      let v: i64 = bytes[i] & 0xff
      buf[i*2]     = hexnib(v >> 4) as u8
      buf[i*2 + 1] = hexnib(v & 0xf) as u8
      i = i + 1
  }
  sys_write(2, buf, n * 2)
  return 0
71}
72
73// Dump U384 (12 LE limbs of 32 bits each) as 96-char big-endian hex.
74func dump_u384(p: *i64) -> i64 {
  let bytes: *u8 = sys_mmap(48)
  var i: i64 = 0
  // U384 LE-limb layout: limb[0] = least-sig 32 bits.
  // For BE hex we want byte 0 = MSB of limb[11].
  while i < 12 {
      let limb: i64 = p[11 - i] & 0xffffffff
      bytes[i*4 + 0] = (limb >> 24) & 0xff
      bytes[i*4 + 1] = (limb >> 16) & 0xff
      bytes[i*4 + 2] = (limb >> 8)  & 0xff
      bytes[i*4 + 3] = limb & 0xff
      i = i + 1
  }
  dump_bytes(bytes, 48)
  return 0
89}
90
91func main() -> i64 {
  // Load cert2.der and cert3.der.
  let p2: *u8 = sys_mmap(64)
  p2[0]=0x2F;p2[1]=0x74;p2[2]=0x6D;p2[3]=0x70;p2[4]=0x2F
  p2[5]=0x63;p2[6]=0x65;p2[7]=0x72;p2[8]=0x74
  p2[9]=0x32;p2[10]=0x2E;p2[11]=0x64;p2[12]=0x65;p2[13]=0x72
  p2[14]=0
  let buf2: *u8 = sys_mmap(4096)
  let n2: i64 = read_to(p2, buf2, 4096)
  if n2 <= 0 { return 1 }
101
  let p3: *u8 = sys_mmap(64)
  p3[0]=0x2F;p3[1]=0x74;p3[2]=0x6D;p3[3]=0x70;p3[4]=0x2F
  p3[5]=0x63;p3[6]=0x65;p3[7]=0x72;p3[8]=0x74
  p3[9]=0x33;p3[10]=0x2E;p3[11]=0x64;p3[12]=0x65;p3[13]=0x72
  p3[14]=0
  let buf3: *u8 = sys_mmap(4096)
  let n3: i64 = read_to(p3, buf3, 4096)
  if n3 <= 0 { return 2 }
110
  let c2_raw: *u8 = sys_mmap(512); let c2: *X509Cert = c2_raw as *X509Cert
  let c3_raw: *u8 = sys_mmap(512); let c3: *X509Cert = c3_raw as *X509Cert
  if x509_parse(buf2, n2, c2) < 0 { return 3 }
  if x509_parse(buf3, n3, c3) < 0 { return 4 }
115
  // ---- 0. SHA-256(cert2.tbs) BEFORE any P-384 work, as a control ----
  let h256_early: *u8 = sys_mmap(32)
  sha256_digest(buf2 + c2.tbs_off, c2.tbs_len, h256_early)
  emit_label(0x53, 0x32, 0x35, 0x36, 0x30)    // "S2560" (early sha256)
  dump_bytes(h256_early, 32); emit_nl()
121
  // ---- 1. SHA-384(cert2.tbs) ----
  let h: *u8 = sys_mmap(48)
  let tbs2: *u8 = buf2 + c2.tbs_off
  sha384_digest(tbs2, c2.tbs_len, h)
  emit_label(0x48, 0x32, 0x53, 0x33, 0x38)    // "H2S38"
  dump_bytes(h, 48); emit_nl()
128
  // ---- 2. parse cert2.sig as P-384 DER ----
  let r: *i64 = u384_alloc()
  let s: *i64 = u384_alloc()
  let sig_ptr: *u8 = buf2 + c2.sig_off
  let pp: i64 = nx_ecdsa_sig_parse_der_384(sig_ptr, c2.sig_len, r, s)
  emit_label(0x44, 0x50, 0x52, 0x43, 0x32)    // "DPRC2" (DER parse rc)
  let prc_buf: *u8 = sys_mmap(8)
  prc_buf[0] = hexnib(pp & 0xf) as u8
  sys_write(2, prc_buf, 1); emit_nl()
138
  emit_label(0x52, 0x32, 0x32, 0x32, 0x32)    // "R2222"
  dump_u384(r); emit_nl()
  emit_label(0x53, 0x32, 0x32, 0x32, 0x32)    // "S2222"
  dump_u384(s); emit_nl()
143
  // ---- 3. extract cert3 pubkey ----
  let px: *i64 = u384_alloc()
  let py: *i64 = u384_alloc()
  let ex: i64 = nx_x509_pubkey_extract_ec_p384(buf3, c3, px, py)
  emit_label(0x45, 0x58, 0x52, 0x43, 0x33)    // "EXRC3"
  let xrc_buf: *u8 = sys_mmap(8)
  xrc_buf[0] = hexnib(ex & 0xf) as u8
  sys_write(2, xrc_buf, 1); emit_nl()
152
  emit_label(0x58, 0x33, 0x33, 0x33, 0x33)    // "X3333"
  dump_u384(px); emit_nl()
  emit_label(0x59, 0x33, 0x33, 0x33, 0x33)    // "Y3333"
  dump_u384(py); emit_nl()
157
  // ---- 4. Call nx_ecdsa_p384_verify directly with these inputs ----
  let e: *i64 = u384_alloc()
  u384_load_be(e, h)
  let v: i64 = nx_ecdsa_p384_verify(px, py, e, r, s)
  emit_label(0x56, 0x52, 0x44, 0x43, 0x54)    // "VRDCT"
  let v_buf: *u8 = sys_mmap(8)
  v_buf[0] = hexnib(v & 0xf) as u8
  sys_write(2, v_buf, 1); emit_nl()
166
  // ---- 5. Call x509_verify_ecdsa_p384 (the wrapper) ----
  let v2: i64 = nx_x509_verify_ecdsa_p384(
      buf2 + c2.tbs_off, c2.tbs_len,
      buf2 + c2.sig_off, c2.sig_len,
      px, py
  )
  emit_label(0x57, 0x52, 0x44, 0x43, 0x54)    // "WRDCT" (wrapper verdict)
  let v2_buf: *u8 = sys_mmap(8)
  v2_buf[0] = hexnib(v2 & 0xf) as u8
  sys_write(2, v2_buf, 1); emit_nl()
177
  // ---- 6. Call x509_verify_under_issuer (the dispatcher) ----
  let v3: i64 = nx_x509_verify_under_issuer(buf2, c2, buf3, c3)
  emit_label(0x44, 0x52, 0x44, 0x43, 0x54)    // "DRDCT" (dispatch verdict)
  let v3_buf: *u8 = sys_mmap(8)
  v3_buf[0] = hexnib(v3 & 0xf) as u8
  sys_write(2, v3_buf, 1); emit_nl()
184
  // ---- 7. Pollution check: parse cert1, verify cert1->cert2 first,
  //         then RE-verify cert2->cert3 to see if prior state breaks
  //         the P-384 path.
  let p1: *u8 = sys_mmap(64)
  p1[0]=0x2F;p1[1]=0x74;p1[2]=0x6D;p1[3]=0x70;p1[4]=0x2F
  p1[5]=0x63;p1[6]=0x65;p1[7]=0x72;p1[8]=0x74
  p1[9]=0x31;p1[10]=0x2E;p1[11]=0x64;p1[12]=0x65;p1[13]=0x72
  p1[14]=0
  let buf1: *u8 = sys_mmap(4096)
  let n1: i64 = read_to(p1, buf1, 4096)
  if n1 <= 0 { return 5 }
  let c1_raw: *u8 = sys_mmap(512); let c1: *X509Cert = c1_raw as *X509Cert
  if x509_parse(buf1, n1, c1) < 0 { return 6 }
  let vA: i64 = nx_x509_verify_under_issuer(buf1, c1, buf2, c2)
  emit_label(0x50, 0x4F, 0x4C, 0x31, 0x32)    // "POL12" (post cert1->cert2)
  let vA_buf: *u8 = sys_mmap(8)
  vA_buf[0] = hexnib(vA & 0xf) as u8
  sys_write(2, vA_buf, 1); emit_nl()
203
  let vB: i64 = nx_x509_verify_under_issuer(buf2, c2, buf3, c3)
  emit_label(0x50, 0x4F, 0x4C, 0x32, 0x33)    // "POL23" (re-cert2->cert3)
  let vB_buf: *u8 = sys_mmap(8)
  vB_buf[0] = hexnib(vB & 0xf) as u8
  sys_write(2, vB_buf, 1); emit_nl()
209
  // ---- 8. Call cert1->cert2 P-256 TWICE in a row to test self-repeat
  let vC: i64 = nx_x509_verify_under_issuer(buf1, c1, buf2, c2)
  emit_label(0x52, 0x50, 0x54, 0x31, 0x32)    // "RPT12" (P-256 repeat 1)
  let vC_buf: *u8 = sys_mmap(8)
  vC_buf[0] = hexnib(vC & 0xf) as u8
  sys_write(2, vC_buf, 1); emit_nl()
216
  let vD: i64 = nx_x509_verify_under_issuer(buf1, c1, buf2, c2)
  emit_label(0x52, 0x50, 0x54, 0x31, 0x33)    // "RPT13" (P-256 repeat 2)
  let vD_buf: *u8 = sys_mmap(8)
  vD_buf[0] = hexnib(vD & 0xf) as u8
  sys_write(2, vD_buf, 1); emit_nl()
222
  // ---- 9. BYPASS dispatcher: call nx_x509_verify_ecdsa_p256 directly
  //         after the P-384 wrapper has already been called.
  let p2x: *i64 = u256_alloc()
  let p2y: *i64 = u256_alloc()
  let exA: i64 = nx_x509_pubkey_extract_ec_p256(buf2, c2, p2x, p2y)
  emit_label(0x45, 0x58, 0x32, 0x35, 0x36)    // "EX256"
  let exA_buf: *u8 = sys_mmap(8)
  exA_buf[0] = hexnib(exA & 0xf) as u8
  sys_write(2, exA_buf, 1); emit_nl()
232
  let vE: i64 = nx_x509_verify_ecdsa_p256(
      buf1 + c1.tbs_off, c1.tbs_len,
      buf1 + c1.sig_off, c1.sig_len,
      p2x, p2y
  )
  emit_label(0x42, 0x50, 0x32, 0x35, 0x36)    // "BP256" (bypass P-256)
  let vE_buf: *u8 = sys_mmap(8)
  vE_buf[0] = hexnib(vE & 0xf) as u8
  sys_write(2, vE_buf, 1); emit_nl()
242
  // ---- 10. Re-parse fresh cert1, cert2 and retry P-256 verify ----
  let c1b_raw: *u8 = sys_mmap(512); let c1b: *X509Cert = c1b_raw as *X509Cert
  let c2b_raw: *u8 = sys_mmap(512); let c2b: *X509Cert = c2b_raw as *X509Cert
  if x509_parse(buf1, n1, c1b) < 0 { return 7 }
  if x509_parse(buf2, n2, c2b) < 0 { return 8 }
  let p2bx: *i64 = u256_alloc()
  let p2by: *i64 = u256_alloc()
  nx_x509_pubkey_extract_ec_p256(buf2, c2b, p2bx, p2by)
  let vF: i64 = nx_x509_verify_ecdsa_p256(
      buf1 + c1b.tbs_off, c1b.tbs_len,
      buf1 + c1b.sig_off, c1b.sig_len,
      p2bx, p2by
  )
  emit_label(0x46, 0x50, 0x32, 0x35, 0x36)    // "FP256" (fresh-parse P-256)
  let vF_buf: *u8 = sys_mmap(8)
  vF_buf[0] = hexnib(vF & 0xf) as u8
  sys_write(2, vF_buf, 1); emit_nl()
260
  // ---- 11. Dump TBS offsets to compare against the leaf test ----
  let off1: i64 = c1.tbs_off
  let len1: i64 = c1.tbs_len
  let off2: i64 = c1.sig_off
  let len2: i64 = c1.sig_len
  emit_label(0x54, 0x42, 0x4F, 0x46, 0x46)    // "TBOFF"
  let o_buf: *u8 = sys_mmap(8)
  o_buf[0]=(0x30 + ((off1 / 100) % 10)) as u8
  o_buf[1]=(0x30 + ((off1 / 10)  % 10)) as u8
  o_buf[2]=(0x30 + (off1 % 10))        as u8
  sys_write(2, o_buf, 3); emit_nl()
  emit_label(0x54, 0x42, 0x4C, 0x45, 0x4E)    // "TBLEN"
  let l_buf: *u8 = sys_mmap(8)
  l_buf[0]=(0x30 + ((len1 / 100) % 10)) as u8
  l_buf[1]=(0x30 + ((len1 / 10)  % 10)) as u8
  l_buf[2]=(0x30 + (len1 % 10))        as u8
  sys_write(2, l_buf, 3); emit_nl()
278
  // ---- 12. SHA-256 isolation check after all the P-384 calls ----
  let h256: *u8 = sys_mmap(32)
  sha256_digest(buf1 + c1.tbs_off, c1.tbs_len, h256)
  emit_label(0x53, 0x32, 0x35, 0x36, 0x3A)    // "S256:"
  dump_bytes(h256, 32); emit_nl()
284
  return 0
286}
nx_ecdsa_p384_real_bisect_test.nx source

`nx_ecdsa_p384_real_bisect_test.nx` source
