code wiki / _hdl_build / nx_quic_keys_test.nx
nx_quic_keys_test.nx source
↩ module page · 51 lines · 3132 B
1// nx_quic_keys_gate.nx -- RUNG 5a gate: QUIC Initial key schedule byte-exact vs RFC 9001 Appendix A.1
2// (DCID 0x8394c8f03e515708 -> initial/client/server secrets, key, iv, hp). Native, sovereign, on our own
3// HKDF-SHA256. GREEN = our key schedule is RFC-9001-correct to the byte. license_tier: ORIGINAL
4import "nx_quic_keys.nx"
5import "nx_g_pn_lite_lib.nx"
6import "nx_g_check_lib.nx"
7import "nx_g_puts_lib.nx"
8
9func hexnib(c: i64) -> i64 {
10 if c >= 48 { if c <= 57 { return c - 48 } }
11 if c >= 97 { if c <= 102 { return c - 87 } }
12 return 0
13}
14func set_hex(out: *u8, hex: *u8, nbytes: i64) -> i64 {
15 var i: i64=0
16 while i < nbytes { out[i] = ((hexnib(hex[i*2] as i64) << 4) | hexnib(hex[i*2+1] as i64)) as u8; i = i + 1 }
17 return 0
18}
19func eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
20
21func main() -> i64 {
22 g_puts("nx_quic_keys gate -- QUIC Initial key schedule vs RFC 9001 A.1\n" as *u8)
23 var pass: i64=0; var total: i64=0
24
25 let dcid: *u8 = sys_mmap(8); set_hex(dcid, "8394c8f03e515708" as *u8, 8)
26
27 let exp_is: *u8 = sys_mmap(32); set_hex(exp_is, "7db5df06e7a69e432496adedb00851923595221596ae2ae9fb8115c1e9ed0a44" as *u8, 32)
28 let is: *u8 = sys_mmap(32); quic_initial_extract(dcid, 8, is)
29 pass = pass + g_check("initial_secret = HKDF-Extract(salt, DCID) (32B)" as *u8, eq(is, exp_is, 32)); total=total+1
30
31 let cs: *u8 = sys_mmap(32); let ss: *u8 = sys_mmap(32)
32 quic_initial_secrets(dcid, 8, cs, ss)
33 let exp_cs: *u8 = sys_mmap(32); set_hex(exp_cs, "c00cf151ca5be075ed0ebfb5c80323c42d6b7db67881289af4008f1f6c357aea" as *u8, 32)
34 let exp_ss: *u8 = sys_mmap(32); set_hex(exp_ss, "3c199828fd139efd216c155ad844cc81fb82fa8d7446fa7d78be803acdda951b" as *u8, 32)
35 pass = pass + g_check("client_initial_secret = Expand-Label(.., 'client in') (32B)" as *u8, eq(cs, exp_cs, 32)); total=total+1
36 pass = pass + g_check("server_initial_secret = Expand-Label(.., 'server in') (32B)" as *u8, eq(ss, exp_ss, 32)); total=total+1
37
38 let key: *u8 = sys_mmap(16); let iv: *u8 = sys_mmap(12); let hp: *u8 = sys_mmap(16)
39 quic_derive_keys(cs, key, iv, hp)
40 let exp_key: *u8 = sys_mmap(16); set_hex(exp_key, "1f369613dd76d5467730efcbe3b1a22d" as *u8, 16)
41 let exp_iv: *u8 = sys_mmap(12); set_hex(exp_iv, "fa044b2f42a3fd3b46fb255c" as *u8, 12)
42 let exp_hp: *u8 = sys_mmap(16); set_hex(exp_hp, "9f50449e04a0e810283a1e9933adedd2" as *u8, 16)
43 pass = pass + g_check("client key = Expand-Label('quic key') (16B AES-128)" as *u8, eq(key, exp_key, 16)); total=total+1
44 pass = pass + g_check("client iv = Expand-Label('quic iv') (12B)" as *u8, eq(iv, exp_iv, 12)); total=total+1
45 pass = pass + g_check("client hp = Expand-Label('quic hp') (16B)" as *u8, eq(hp, exp_hp, 16)); total=total+1
46
47 g_puts("---- quic_keys gate: passed " as *u8); g_pn(pass); g_puts(" / " as *u8); g_pn(total); g_puts(" ----\n" as *u8)
48 if pass == total { g_puts("VERDICT: GREEN (QUIC Initial key schedule, RFC 9001 A.1 byte-exact, sovereign HKDF)\n" as *u8); return 0 }
49 g_puts("VERDICT: RED\n" as *u8)
50 return 1
51}