code wiki / _hdl_build / nx_sha256_wasm_vm_gate.nx
`nx_sha256_wasm_vm_gate.nx` source

1// nx_sha256_wasm_vm_gate.nx -- proves the byte-width backend fix GENERALIZES beyond the codec, on security-critical
2// crypto, and demonstrates the sovereign WASM VM as a general verifier. nx_sha256_wasm was BLOCKED since 2026-05-16 on
3// the WAT backend memory codegen (its header documents the fallback to browser crypto = sovereignty debt). We compile
4// it with the fixed backend, EXECUTE the shipped wasm in nx_wasm_vm, and check SHA-256 of abc against the FIPS KAT.
5import "nx_syscalls.nx"
6import "nx_gate_emit_lib.nx"
7import "nx_wasm_vm.nx"
8
9func main() -> i64 {
10    g_puts("nx_sha256_wasm VM gate (fixed-backend wasm SHA-256, executed in nx_wasm_vm, vs FIPS KAT)\n" as *u8)
11    var pass: i64 = 0; var total: i64 = 0
12
13    let box: *i64 = sys_mmap(16) as *i64
14    let wasm: *u8 = sys_read_file("/mnt/c/Users/elder/nishi-core/nxc2/web_assets/_video_build/nx_sha256.wasm" as *u8, box)
15    if (wasm as i64) == 0 { g_puts("  FAIL cannot read nx_sha256.wasm\n" as *u8); g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 }
16    let mod: *WasmMod = wm_new(wasm, box[0])
17    if wm_parse(mod) != 0 { g_puts("  FAIL parse\n" as *u8); g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 }
18    mod.mem = sys_mmap(65536) as *u8
19    let fidx: i64 = wm_find_export(mod, "nx_sha256_one_shot" as *u8)
20    g_puts("  [measure] funcs=" as *u8); g_pn(mod.n_funcs); g_puts(" exports=" as *u8); g_pn(mod.n_exports); g_puts(" one_shot fidx=" as *u8); g_pn(fidx); g_puts("\n" as *u8)
21    pass = pass + g_check("nx_sha256_one_shot is exported (wasm compiled + structured)" as *u8, fidx >= 0); total=total+1
22
23    // input bytes 'a','b','c' at mem[0..2]; ctx scratch at 512; 32-byte digest out at 2048
24    mod.mem[0] = 97 as u8; mod.mem[1] = 98 as u8; mod.mem[2] = 99 as u8
25    wm_run(mod, "nx_sha256_one_shot" as *u8, 0, 3, 512, 2048, 0, 4)
26
27    // FIPS 180-4 KAT, SHA-256 of abc = ba7816bf...f20015ad. Check digest bytes at out_ptr (first four + last).
28    let d0: i64 = mod.mem[2048] as i64
29    let d1: i64 = mod.mem[2049] as i64
30    let d2: i64 = mod.mem[2050] as i64
31    let d3: i64 = mod.mem[2051] as i64
32    let dl: i64 = mod.mem[2079] as i64
33    g_puts("  [measure] VM digest = " as *u8)
34    g_pn(d0); g_puts(" " as *u8); g_pn(d1); g_puts(" " as *u8); g_pn(d2); g_puts(" " as *u8); g_pn(d3); g_puts(" ... " as *u8); g_pn(dl)
35    g_puts("  (FIPS expect 186 120 22 191 ... 173)\n" as *u8)
36    var ok: i64 = 0
37    if d0==186 { if d1==120 { if d2==22 { if d3==191 { if dl==173 { ok=1 } } } } }
38    pass = pass + g_check("SHA-256(abc) via the shipped wasm matches the FIPS KAT (byte-width fix works for crypto)" as *u8, ok); total=total+1
39
40    g_puts("---- sha256_wasm VM gate: passed " as *u8); g_pn(pass); g_puts(" / " as *u8); g_pn(total); g_puts(" ----\n" as *u8)
41    if pass == total { g_puts("verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
42    g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1
43}
nx_sha256_wasm_vm_gate.nx source

`nx_sha256_wasm_vm_gate.nx` source
