code wiki / _hdl_build / nx_opaque_kat_register.nx
`nx_opaque_kat_register.nx` source

1// nx_opaque_kat_register.nx -- registers the OPAQUE auth arc (V-MODAUTH-2/4/6/7).
2// ENGINEER evidence = all three gates are REBUILT + rerun here (prove-all):
3//   nx_opaque_rfc_kat        RFC 9807 C.1.5 + C.1.6 byte-exact + negatives
4//   nx_modauth_e2e_gate      register/login/validate full stack 10/10
5//   nx_wiki_login_live_gate  HTTP login + session gate 8/8
6// Atomic alloc via the Librarian. license_tier: ORIGINAL
7import "nx_cap_register.nx"
8import "nx_capreg_librarian.nx"
9import "nx_syscalls.nx"
10
11func okr_build_run(name: *u8) -> i64 {
12    let pid: i64 = sys_fork()
13    if pid == 0 {
14        let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4)
15        if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
16        let argv: *i64 = sys_mmap(32) as *i64
17        argv[0] = "_offc/nx_sov_build_run.elf" as *u8 as i64
18        argv[1] = name as i64
19        argv[2] = 0
20        let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
21        sys_execve("_offc/nx_sov_build_run.elf" as *u8, argv, envp); sys_exit(127)
22    }
23    let st: *i64 = sys_mmap(16) as *i64
24    sys_wait4(pid, st, 0)
25    return st[0]
26}
27
28func main() -> i64 {
29    var allok: i64 = 1
30    if okr_build_run("nx_opaque_rfc_kat" as *u8) != 0 { allok = 0; cr_w(1, "RED nx_opaque_rfc_kat\n" as *u8) }
31    if okr_build_run("nx_modauth_e2e_gate" as *u8) != 0 { allok = 0; cr_w(1, "RED nx_modauth_e2e_gate\n" as *u8) }
32    if okr_build_run("nx_wiki_login_live_gate" as *u8) != 0 { allok = 0; cr_w(1, "RED nx_wiki_login_live_gate\n" as *u8) }
33    cr_w(1, "ENGINEER: OPAQUE arc 3-gate rebuild+rerun pass=" as *u8); cr_wn(1, allok); cr_w(1, "\n" as *u8)
34    let eng: i64 = ig_engineer(1, 1, 1, allok)
35    let dec: i64 = ig_decision(eng, ig_council(eng, 1, 1, 2), 1)
36    if dec != IG_INGEST { cr_w(1, "HELD\n" as *u8); sys_exit(1) }
37    if cr_can_register(5, 2, 6, dec) != 1 { cr_w(1, "REFUSED\n" as *u8); sys_exit(1) }
38    let lp: *u8 = "/tmp/nishi_cap_registry.log" as *u8
39    let jp: *u8 = "knowledge/status/cap_registry_durable.log" as *u8
40
41    let idx1: i64 = cl_next_idx(lp, jp)
42    let ok1: i64 = cl_register_dual(lp, jp, idx1, 2, 2, "SEC OPAQUE-RFC9807 (asymmetric PAKE, the auth crown jewel) -- full OPAQUE-3DH over OPRF(P-256,SHA-256): hub/nx_opaque_core (HashToScalar mod-n + RFC9497 DeriveKeyPair + P-256 DiffieHellman + TLS-style Expand-Label + argon2id KSF hook) + nx_opaque_envelope (RFC9807 s4 Store/Recover) + nx_opaque_3dh (preamble + DeriveKeys key schedule) + nx_opaque_pake (registration trio + KE1/KE2/KE3/ServerFinish; deterministic cores for KAT injection + CSPRNG wrappers). GATE nx_opaque_rfc_kat: RFC 9807 Appendix C.1.5 AND C.1.6 (explicit identities) BYTE-EXACT on every wire message (registration_request/response/upload, KE1 98B, KE2 259B, KE3, export_key, session_key both sides) + wrong-password/tampered-server-mac/tampered-KE3 all rejected + production-randomness round trip. Server stores NOTHING offline-crackable without the separate oprf_seed; each guess pays memory-hard argon2id. Composes the CAPREG299 VOPRF. Compiler landmines hit+fixed: parser rejects empty-string literal and multi-line continuation expressions (both documented in source)")
43    if ok1 != 1 { cr_w(1, "DUAL-WRITE-1 FAILED\n" as *u8); sys_exit(1) }
44    cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, idx1); cr_w(1, " REGISTERED (OPAQUE RFC9807)\n" as *u8)
45
46    let idx2: i64 = cl_next_idx(lp, jp)
47    let ok2: i64 = cl_register_dual(lp, jp, idx2, 2, 2, "SEC WIKI-ACCESS-GATE (sites can gate non-public features behind secure login) -- V-MODAUTH-4 hub/nx_user_account_store (additive-only record log, latest-wins supersede, 0600 server key bundle load-or-init idempotent) + V-MODAUTH-6 nx_modern_auth_register/login IMPLEMENTED (in-process OPAQUE both-roles on TLS-delivered passphrase; honest scope: wire-PAKE wasm client = named V-MODAUTH-8 rung, record format already RFC wire format so that client lands with zero server change) + V-MODAUTH-7 wiki wiring LIVE: POST /wiki/admin/login (form-urlencoded, urldecode) -> 200 {token:base64} or 401; X-Nishi-Session base64 accepted on GET. GATES: nx_modauth_e2e_gate 10/10 (keygen idempotent, register, login, validate, wrong-pw, tamper, expiry, re-register supersede, unknown user) + nx_wiki_login_live_gate 8/8 over real HTTP bytes incl. honest-503-unarmed + enumeration-defense-401. FOUND+FIXED latent V1 bug: X-Nishi-Session name length const was 16 (string is 15) so the session header NEVER matched -- the authed path had never actually run; live gate row 3 caught it. Daemon mv boot now arms ctx from persistent bundle (NAS volume convention); retires wiki sha256-passphrase debt B#login-pass-hash-not-memory-hard at the wiring level")
48    if ok2 != 1 { cr_w(1, "DUAL-WRITE-2 FAILED\n" as *u8); sys_exit(1) }
49    cr_w(1, "CAPREG idx=" as *u8); cr_wn(1, idx2); cr_w(1, " REGISTERED (wiki access gate)\n" as *u8)
50    sys_exit(0)
51    return 0
52}
nx_opaque_kat_register.nx source

`nx_opaque_kat_register.nx` source
