nx_sealed_sender_gate.nx source
↩ module page · 168 lines · 9101 B
1// nx_sealed_sender_gate.nx -- REFEREE for C9 (nx_sealed_sender, contract ss_seal). END-TO-END: keygens
2// two Ed25519 identities, seals a message, and forks the PROMOTED elf to prove the pre-declared
3// done-rule: the sender's identity appears in NO relay-readable byte -- proven by SCANNING the actual
4// envelope file on disk (the relay's own capture) for the sender pubkey and the plaintext.
5// license_tier: ORIGINAL expect_exit: 0
6import "nx_syscalls.nx"
7import "nx_tool_run.nx"
8import "nx_gate_verdict.nx"
9const SSG_CAP: i64 = 65536
10func ssg_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
11func ssg_count(buf: *u8, n: i64, needle: *u8) -> i64 {
12 let m: i64 = ssg_len(needle)
13 if m <= 0 { return 0 }
14 var c: i64 = 0
15 var i: i64 = 0
16 while i + m <= n {
17 var k: i64 = 0
18 var hit: i64 = 1
19 while k < m { if buf[i+k] != needle[k] { hit = 0; k = m } else { k = k + 1 } }
20 if hit == 1 { c = c + 1; i = i + m } else { i = i + 1 }
21 }
22 return c
23}
24func ssg_after(buf: *u8, n: i64, after: *u8, out: *u8) -> i64 {
25 let m: i64 = ssg_len(after)
26 var pos: i64 = 0 - 1
27 var i: i64 = 0
28 while i + m <= n {
29 var k: i64 = 0
30 var hit: i64 = 1
31 while k < m { if buf[i+k] != after[k] { hit = 0; k = m } else { k = k + 1 } }
32 if hit == 1 { pos = i + m }
33 i = i + 1
34 }
35 if pos < 0 { out[0] = 0 as u8; return 0 - 1 }
36 var o: i64 = 0
37 while pos < n { let c: i64 = buf[pos] as i64; if c <= 32 { break } out[o] = buf[pos] as u8; o = o + 1; pos = pos + 1 }
38 out[o] = 0 as u8
39 return o
40}
41func ssg_read(path: *u8, buf: *u8, cap: i64) -> i64 {
42 let fd: i64 = sys_openat_rd(path)
43 if fd < 0 { return 0 - 1 }
44 var tot: i64 = 0
45 while tot < cap { let r: i64 = sys_read(fd, (buf as i64 + tot) as *u8, cap - tot); if r <= 0 { break } tot = tot + r }
46 sys_close(fd)
47 return tot
48}
49func ssg_run(elf: *u8, av: *i64, out: *u8, ol: *i64) -> i64 { return tr_run_capture(elf, av, out, SSG_CAP, ol) }
50func main(argc: i64, argv: *i64) -> i64 {
51 let ctr: *i64 = gv_ctr()
52 gv_head("nx_sealed_sender -- the relay routes without learning WHO sent the message; the sender is signed inside the sealed payload" as *u8)
53 let ELF: *u8 = "/volume1/homes/elderwesto/nishihost/nx_sealed_sender.elf" as *u8
54 sys_mkdir("/tmp/ssg" as *u8, 493)
55 let out: *u8 = sys_mmap(SSG_CAP)
56 let ol: *i64 = sys_mmap(16) as *i64
57 let av: *i64 = sys_mmap(64) as *i64
58 // a KNOWN room key (in production this is the C7 epoch secret)
59 let RK: *u8 = "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef" as *u8
60 let PLAINTEXT: *u8 = "meet at the usual place" as *u8
61 let pubA: *u8 = sys_mmap(256)
62 let pubB: *u8 = sys_mmap(256)
63 // ---- T1 two Ed25519 sender identities ------------------------------------------------------
64 av[0] = ELF as i64
65 av[1] = "keygen" as i64
66 av[2] = "/tmp/ssg/alice.priv" as i64
67 av[3] = "aaaa1111" as i64
68 av[4] = 0
69 let k1: i64 = ssg_run(ELF, av, out, ol)
70 ssg_after(out, ol[0], "PUB " as *u8, pubA)
71 av[2] = "/tmp/ssg/mallory.priv" as i64
72 av[3] = "bbbb2222" as i64
73 let k2: i64 = ssg_run(ELF, av, out, ol)
74 ssg_after(out, ol[0], "PUB " as *u8, pubB)
75 var t1: i64 = 0
76 if k1 == 0 { if k2 == 0 { if ssg_len(pubA) == 64 { if ssg_len(pubB) == 64 { t1 = 1 } } } }
77 gv_check("T1 BITE: two Ed25519 sender identities generated (64-hex pubkeys)" as *u8, t1, ctr)
78 // ---- T2 alice seals a message --------------------------------------------------------------
79 av[1] = "seal" as i64
80 av[2] = RK as i64
81 av[3] = "/tmp/ssg/alice.priv" as i64
82 av[4] = "5" as i64
83 av[5] = PLAINTEXT as i64
84 av[6] = "/tmp/ssg/env" as i64
85 av[7] = 0
86 let s1: i64 = ssg_run(ELF, av, out, ol)
87 var t2: i64 = 0
88 if s1 == 0 { if ssg_count(out, ol[0], "SEAL-OK" as *u8) == 1 { t2 = 1 } }
89 gv_check("T2 alice seals a message into a relay-blind envelope" as *u8, t2, ctr)
90 // ---- T3 THE MONEY TOOTH: the sender's identity is ABSENT from the envelope bytes -----------
91 let envbuf: *u8 = sys_mmap(SSG_CAP)
92 let envn: i64 = ssg_read("/tmp/ssg/env" as *u8, envbuf, SSG_CAP)
93 var t3: i64 = 0
94 if envn > 0 { if ssg_count(envbuf, envn, pubA) == 0 { t3 = 1 } }
95 gv_check("T3 SEALED SENDER: the sender's Ed25519 pubkey appears in ZERO bytes of the actual envelope file -- the relay's capture cannot reveal WHO sent it" as *u8, t3, ctr)
96 // ---- T4 the content is also absent (E2EE) --------------------------------------------------
97 var t4: i64 = 0
98 if envn > 0 { if ssg_count(envbuf, envn, "meet at the usual place" as *u8) == 0 { t4 = 1 } }
99 gv_check("T4 the plaintext appears in ZERO bytes of the envelope -- content is sealed too" as *u8, t4, ctr)
100 // ---- T5 the relay view is ONLY a routing token + seq ---------------------------------------
101 av[1] = "route" as i64
102 av[2] = "/tmp/ssg/env" as i64
103 av[3] = 0
104 let r1: i64 = ssg_run(ELF, av, out, ol)
105 var t5: i64 = 0
106 if r1 == 0 { if ssg_count(out, ol[0], "RELAY-VIEW routing_token=" as *u8) == 1 { if ssg_count(out, ol[0], pubA) == 0 { t5 = 1 } } }
107 gv_check("T5 the relay's own view is an opaque routing token + delivery seq, and the sender pubkey is not in it" as *u8, t5, ctr)
108 // ---- T6 ANTI-VACUITY: the recipient DOES recover sender + content --------------------------
109 av[1] = "open" as i64
110 av[2] = RK as i64
111 av[3] = "/tmp/ssg/env" as i64
112 av[4] = 0
113 let o1: i64 = ssg_run(ELF, av, out, ol)
114 var t6: i64 = 0
115 if o1 == 0 { if ssg_count(out, ol[0], "SEAL-OPEN-OK" as *u8) == 1 { if ssg_count(out, ol[0], pubA) == 1 { if ssg_count(out, ol[0], "sig=VALID" as *u8) == 1 { if ssg_count(out, ol[0], "plaintext=meet at the usual place" as *u8) == 1 { t6 = 1 } } } } }
116 gv_check("T6 ANTI-VACUITY: the recipient (holding the room key) recovers the sender pubkey, a VALID signature, and the plaintext -- sealed is not merely absent" as *u8, t6, ctr)
117 // ---- T7 AUTHENTICATED: the recovered sender is ALICE, not mallory --------------------------
118 var t7: i64 = 0
119 if o1 == 0 { if ssg_count(out, ol[0], pubA) == 1 { if ssg_count(out, ol[0], pubB) == 0 { t7 = 1 } } }
120 gv_check("T7 SENDER AUTHENTICATED: the recovered identity is alice's pubkey (and NOT mallory's) -- the Ed25519 signature binds the true sender" as *u8, t7, ctr)
121 // ---- T8 WRONG KEY: a relay/outsider with the WRONG room key cannot open ---------------------
122 av[1] = "open" as i64
123 av[2] = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" as i64
124 av[3] = "/tmp/ssg/env" as i64
125 av[4] = 0
126 let o2: i64 = ssg_run(ELF, av, out, ol)
127 var t8: i64 = 0
128 if o2 != 0 { if ssg_count(out, ol[0], "SEAL-OPEN-DENIED" as *u8) == 1 { if ssg_count(out, ol[0], "meet at the usual place" as *u8) == 0 { t8 = 1 } } }
129 gv_check("T8 neg-control-wrongkey: an outsider (or the relay) with the wrong room key cannot open the envelope -- MAC fails, nothing decrypted" as *u8, t8, ctr)
130 // ---- T9 FORGERY: mallory seals claiming the same room, but her sig is HERS not alice's ------
131 av[1] = "seal" as i64
132 av[2] = RK as i64
133 av[3] = "/tmp/ssg/mallory.priv" as i64
134 av[4] = "5" as i64
135 av[5] = "i am alice trust me" as i64
136 av[6] = "/tmp/ssg/env_m" as i64
137 av[7] = 0
138 ssg_run(ELF, av, out, ol)
139 av[1] = "open" as i64
140 av[2] = RK as i64
141 av[3] = "/tmp/ssg/env_m" as i64
142 av[4] = 0
143 let o3: i64 = ssg_run(ELF, av, out, ol)
144 var t9: i64 = 0
145 if o3 == 0 { if ssg_count(out, ol[0], pubB) == 1 { if ssg_count(out, ol[0], pubA) == 0 { t9 = 1 } } }
146 gv_check("T9 NO-SPOOF: a message from mallory opens as MALLORY's pubkey, never alice's -- the sealed identity is the signing key, not a claimable field" as *u8, t9, ctr)
147 // ---- T10 TAMPER-SIG: splice alice's envelope ct but it fails the MAC ------------------------
148 let ebuf: *u8 = sys_mmap(SSG_CAP)
149 let efd: i64 = sys_openat_rd("/tmp/ssg/env" as *u8)
150 var ecn: i64 = 0
151 if efd >= 0 { ecn = sys_read(efd, ebuf, SSG_CAP); sys_close(efd) }
152 var mid: i64 = 60
153 if mid >= ecn { mid = ecn / 2 }
154 if ebuf[mid] == (97 as u8) { ebuf[mid] = 98 as u8 } else { ebuf[mid] = 97 as u8 }
155 let tfd: i64 = sys_openat_wr("/tmp/ssg/env_bad" as *u8, 420)
156 var tw: i64 = 0
157 while tw < ecn { let r: i64 = sys_write(tfd, (ebuf as i64 + tw) as *u8, ecn - tw); if r <= 0 { break } tw = tw + r }
158 sys_close(tfd)
159 av[1] = "open" as i64
160 av[2] = RK as i64
161 av[3] = "/tmp/ssg/env_bad" as i64
162 av[4] = 0
163 let o4: i64 = ssg_run(ELF, av, out, ol)
164 var t10: i64 = 0
165 if o4 != 0 { if ssg_count(out, ol[0], "meet at the usual place" as *u8) == 0 { t10 = 1 } }
166 gv_check("T10 neg-control-tamper: a flipped envelope byte is rejected (MAC or signature) and NOTHING is decrypted" as *u8, t10, ctr)
167 return gv_verdict("SEALED-SENDER-GATE" as *u8, ctr, "the sender identity and content appear in no relay-readable byte; the recipient recovers a signed, authenticated sender; wrong-key, forgery and tamper all refuse" as *u8)
168}