nx_genpass.nx source
↩ module page · 28 lines · 1369 B
1// nx_genpass.nx -- generate 32 CSPRNG bytes -> 64 hex chars -> a 0600 file (default /tmp/nxsecret.in), for
2// vault sealing. NEVER prints the secret (only a confirmation). Sovereign (nx_csprng). Use before
3// `nx_secret_cli put <name>` to seal a fresh random passphrase without it ever touching stdout/argv.
4// nx_genpass [outfile]
5// license_tier: ORIGINAL
6import "nx_syscalls.nx"
7import "nx_csprng.nx"
8
9const GP_BYTES: i64 = 32 // 32 random bytes -> 64 hex chars = a strong passphrase
10
11func gp_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12
13func main(argc: i64, argv: *i64) -> i64 {
14 var out: *u8 = "/tmp/nxsecret.in\x00" as *u8
15 if argc >= 2 { out = argv[1] as *u8 }
16 let raw: *u8 = sys_mmap(GP_BYTES)
17 if nx_csprng_fill(raw, GP_BYTES) != 0 { sys_write(2, "genpass: csprng failed\n" as *u8, 23); return 1 }
18 let hx: *u8 = "0123456789abcdef" as *u8
19 let hex: *u8 = sys_mmap(GP_BYTES*2)
20 var i: i64 = 0
21 while i < GP_BYTES { hex[i*2] = hx[((raw[i] as i64)>>4)&15]; hex[i*2+1] = hx[(raw[i] as i64)&15]; i = i+1 }
22 let fd: i64 = sys_openat_wr(out, 0x180) // 0600
23 if fd < 0 { sys_write(2, "genpass: cannot open outfile\n" as *u8, 29); return 2 }
24 sys_write(fd, hex, GP_BYTES*2)
25 sys_close(fd)
26 gp_w("genpass: wrote a 64-hex passphrase (0600, not shown)\n" as *u8)
27 return 0
28}