nx_mtls_pkcs12_ecdsa.nx source
↩ module page · 64 lines · 4586 B
1// nx_mtls_pkcs12_ecdsa.nx -- ECDSA-P256 .p12 driver (the browser-interop-safe provisioning, rung R5c).
2//
3// Reads the OPAQUE-bound EC identity (priv scalar + self-signed ECDSA cert) emitted by nx_mtls_ecdsa, builds
4// the EC PKCS#8 (RFC 5915 ECPrivateKey inside a OneAsymmetricKey with the prime256v1 AlgorithmIdentifier),
5// and wraps it via the key-type-agnostic nx_mtls_emit_pkcs12_from (the proven PBES2 + PKCS#12-KDF/HMAC + PFX
6// container). DECOUPLED via /tmp files because the x509-build hub (cert/key gen) and the pkcs12 container
7// (hmac/pbkdf2/sha256) have clashing SHA-256 closures and cannot co-import. Output: a .p12 Chrome/Edge/Firefox
8// + the Windows cert store all import. Validated end-to-end by openssl + python (dev-time). license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10import "nx_mtls_pkcs12.nx" // nx_mtls_emit_pkcs12_from + nxae_* (via nx_asn1_emit)
11const K_MAGIC_4096: i64 = 4096
12const K_MAGIC_8192: i64 = 8192
13
14// EC OIDs (DER value bytes): ecPublicKey 1.2.840.10045.2.1 ; prime256v1 1.2.840.10045.3.1.7
15func ecp_oid_ecpubkey(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0xce as u8;o[4]=0x3d as u8;o[5]=0x02 as u8;o[6]=0x01 as u8; return 7 }
16func ecp_oid_p256(o: *u8) -> i64 { o[0]=0x2a as u8;o[1]=0x86 as u8;o[2]=0x48 as u8;o[3]=0xce as u8;o[4]=0x3d as u8;o[5]=0x03 as u8;o[6]=0x01 as u8;o[7]=0x07 as u8; return 8 }
17
18func ecp_read(path: *u8, buf: *u8, cap: i64) -> i64 {
19 let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 - 1 }
20 var tot: i64 = 0
21 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
22 sys_close(fd); return tot
23}
24func ecp_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
25func ecp_putn(v: i64) -> i64 { let t: *u8 = sys_mmap(24); var m: i64 = v; var k: i64 = 0; if m==0 { t[0]=48 as u8; k=1 } while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } let o: *u8 = sys_mmap(24); var i: i64=0; while i<k { o[i]=t[k-1-i]; i=i+1 } sys_write(1,o,k); return 0 }
26
27func main() -> i64 {
28 ecp_puts("nx_mtls_pkcs12_ecdsa: EC priv+cert -> EC PKCS#8 -> .p12 -> /tmp/nishi_ec_client.p12\n" as *u8)
29 let priv32: *u8 = sys_mmap(64); let pn: i64 = ecp_read("/tmp/nishi_ec_priv.bin" as *u8, priv32, 64)
30 let cert: *u8 = sys_mmap(K_MAGIC_4096); let cn: i64 = ecp_read("/tmp/nishi_ec_cert.der" as *u8, cert, K_MAGIC_4096)
31 if pn != 32 { ecp_puts("PRIV READ FAIL (run nx_mtls_ecdsa first)\n" as *u8); sys_exit(1) }
32 if cn <= 0 { ecp_puts("CERT READ FAIL\n" as *u8); sys_exit(1) }
33
34 // ECPrivateKey = SEQ { INTEGER 1, OCTET STRING(priv32) } (RFC 5915; pubkey recoverable from d + curve)
35 let ecpk_in: *u8 = sys_mmap(64); let eo: *i64 = sys_mmap(8) as *i64; eo[0] = 0
36 nxae_put_int_u8(ecpk_in, eo, 64, 1)
37 nxae_put_octet_string(ecpk_in, eo, 64, priv32, 32)
38 let ecpk: *u8 = sys_mmap(96); let eco: *i64 = sys_mmap(8) as *i64; eco[0] = 0
39 nxae_put_tlv(ecpk, eco, 96, 0x30, ecpk_in, eo[0])
40
41 // AlgorithmIdentifier = SEQ { OID ecPublicKey, OID prime256v1 }
42 let o1: *u8 = sys_mmap(16); let o1n: i64 = ecp_oid_ecpubkey(o1)
43 let o2: *u8 = sys_mmap(16); let o2n: i64 = ecp_oid_p256(o2)
44 let alg_in: *u8 = sys_mmap(64); let ao: *i64 = sys_mmap(8) as *i64; ao[0] = 0
45 nxae_put_oid(alg_in, ao, 64, o1, o1n)
46 nxae_put_oid(alg_in, ao, 64, o2, o2n)
47
48 // PKCS#8 OneAsymmetricKey = SEQ { INTEGER 0, AlgorithmIdentifier, OCTET STRING(ECPrivateKey) }
49 let pk8_in: *u8 = sys_mmap(192); let p8o: *i64 = sys_mmap(8) as *i64; p8o[0] = 0
50 nxae_put_int_u8(pk8_in, p8o, 192, 0)
51 nxae_put_tlv(pk8_in, p8o, 192, 0x30, alg_in, ao[0])
52 nxae_put_octet_string(pk8_in, p8o, 192, ecpk, eco[0])
53 let pk8w: *u8 = sys_mmap(224); let pk8w_o: *i64 = sys_mmap(8) as *i64; pk8w_o[0] = 0
54 nxae_put_tlv(pk8w, pk8w_o, 224, 0x30, pk8_in, p8o[0])
55
56 let p12: *u8 = sys_mmap(K_MAGIC_8192); let pp: *i64 = sys_mmap(8) as *i64
57 if nx_mtls_emit_pkcs12_from(pk8w, pk8w_o[0], cert, cn, "nishi" as *u8, 5, p12, K_MAGIC_8192, pp) != 0 { ecp_puts("EMIT FAIL\n" as *u8); sys_exit(1) }
58 let fd: i64 = sys_openat_wr("/tmp/nishi_ec_client.p12" as *u8, 0x1a4)
59 if fd >= 0 { sys_write(fd, p12, pp[0]); sys_close(fd) } else { ecp_puts("WRITE FAIL\n" as *u8); sys_exit(1) }
60 ecp_puts("wrote /tmp/nishi_ec_client.p12 bytes="); ecp_putn(pp[0]); ecp_puts(" (password: nishi)\n" as *u8)
61 ecp_puts("NX-MTLS-PKCS12-ECDSA EMITTED -- validate: openssl pkcs12 -in /tmp/nishi_ec_client.p12 -passin pass:nishi -info -noout\n" as *u8)
62 sys_exit(0)
63 return 0
64}