code wiki / _hdl_build / nx_sha256_wasm_vm_gate.nx
nx_sha256_wasm_vm_gate.nx source
↩ module page · 51 lines · 3344 B
1// nx_sha256_wasm_vm_gate.nx -- proves the byte-width backend fix GENERALIZES beyond the codec, on security-critical
2// crypto, and demonstrates the sovereign WASM VM as a general verifier. nx_sha256_wasm was BLOCKED since 2026-05-16 on
3// the WAT backend memory codegen (its header documents the fallback to browser crypto = sovereignty debt). We compile
4// it with the fixed backend, EXECUTE the shipped wasm in nx_wasm_vm, and check SHA-256 of abc against the FIPS KAT.
5import "nx_syscalls.nx"
6import "nx_gate_emit_lib.nx"
7import "nx_wasm_vm.nx"
8import "nx_gate_verdict.nx"
9
10func main() -> i64 {
11 g_puts("nx_sha256_wasm VM gate (fixed-backend wasm SHA-256, executed in nx_wasm_vm, vs FIPS KAT)\n" as *u8)
12 var pass: i64 = 0; var total: i64 = 0
13
14 let box: *i64 = sys_mmap(16) as *i64
15 let wasm: *u8 = sys_read_file("/mnt/c/Users/elder/nishi-core/nxc2/web_assets/_video_build/nx_sha256.wasm" as *u8, box)
16 if (wasm as i64) == 0 { g_puts(" FAIL cannot read nx_sha256.wasm\n" as *u8); g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 }
17 let mod: *WasmMod = wm_new(wasm, box[0])
18 if wm_parse(mod) != 0 { g_puts(" FAIL parse\n" as *u8); g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 }
19 mod.mem = sys_mmap(65536) as *u8
20 let fidx: i64 = wm_find_export(mod, "nx_sha256_one_shot" as *u8)
21 g_puts(" [measure] funcs=" as *u8); g_pn(mod.n_funcs); g_puts(" exports=" as *u8); g_pn(mod.n_exports); g_puts(" one_shot fidx=" as *u8); g_pn(fidx); g_puts("\n" as *u8)
22 pass = pass + g_check("nx_sha256_one_shot is exported (wasm compiled + structured)" as *u8, fidx >= 0); total=total+1
23
24 // input bytes 'a','b','c' at mem[0..2]; ctx scratch at 512; 32-byte digest out at 2048
25 mod.mem[0] = 97 as u8; mod.mem[1] = 98 as u8; mod.mem[2] = 99 as u8
26 wm_run(mod, "nx_sha256_one_shot" as *u8, 0, 3, 512, 2048, 0, 4)
27
28 // FIPS 180-4 KAT, SHA-256 of abc = ba7816bf...f20015ad. Check digest bytes at out_ptr (first four + last).
29 let d0: i64 = mod.mem[2048] as i64
30 let d1: i64 = mod.mem[2049] as i64
31 let d2: i64 = mod.mem[2050] as i64
32 let d3: i64 = mod.mem[2051] as i64
33 let dl: i64 = mod.mem[2079] as i64
34 g_puts(" [measure] VM digest = " as *u8)
35 g_pn(d0); g_puts(" " as *u8); g_pn(d1); g_puts(" " as *u8); g_pn(d2); g_puts(" " as *u8); g_pn(d3); g_puts(" ... " as *u8); g_pn(dl)
36 g_puts(" (FIPS expect 186 120 22 191 ... 173)\n" as *u8)
37 var ok: i64 = 0
38 if d0==186 { if d1==120 { if d2==22 { if d3==191 { if dl==173 { ok=1 } } } } }
39 pass = pass + g_check("SHA-256(abc) via the shipped wasm matches the FIPS KAT (byte-width fix works for crypto)" as *u8, ok); total=total+1
40
41 g_puts("---- sha256_wasm VM gate: passed " as *u8); g_pn(pass); g_puts(" / " as *u8); g_pn(total); g_puts(" ----\n" as *u8)
42 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
43 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
44 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
45 let ctr__dry: *i64 = gv_ctr()
46 ctr__dry[0] = pass
47 ctr__dry[1] = total
48 let rc__dry: i64 = gv_verdict("SHA256-WASM-VM-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
49 sys_exit(rc__dry)
50 return rc__dry
51}