nx_tls13_p256_loopback_test.nx source
↩ module page · 127 lines · 5286 B
1// nx_tls13_p256_loopback_test.nx -- server side of rung
2// B4-P256-KEYSHARE: SOVEREIGN loopback proof that OUR server
3// completes a TLS 1.3 key exchange on secp256r1.
4//
5// Found 2026-06-10 (B2 census): nishifamily.com -- our own server
6// stack -- FAILED a P-256-only probe because recv_ch extracted
7// x25519 shares only. This row proves the healed path end-to-end
8// in-memory, no sockets:
9//
10// 1. client session emits a P-256-ONLY ClientHello (the same
11// census mode the ch-compat github leg uses LIVE)
12// 2. server recv_ch accepts it WITHOUT HelloRetryRequest
13// (kex_group = 23, client share captured)
14// 3. server emit_sh answers with a secp256r1 KeyShareEntry
15// 4. client recv_sh completes its side (P-256 ECDH + schedule)
16// 5. server derive_hs completes its side
17// 6. THE PROOF: both sides hold byte-identical c/s handshake
18// traffic secrets (only possible if both P-256 ECDH halves
19// agree on the shared x-coordinate)
20// 7. boundary: corrupted (off-curve) client share -> server
21// derive_hs rejects with PROTOCOL_ERR, never INTERNAL
22//
23// Composes the github live leg (client vs independent peer) into a
24// closed sovereign loop (our client vs OUR server). Deploying the
25// healed server to nishifamily = follow-up (sites-daemon rebuild).
26//
27// expect_exit: 0
28// license_tier: ORIGINAL
29
30import "nx_syscalls.nx"
31import "nx_tls13.nx"
32import "nx_tls13_hello.nx"
33import "nx_tls13_transcript.nx"
34import "nx_tls13_client_session.nx"
35import "nx_tls13_client_session_recv_sh.nx"
36import "nx_tls13_server_session.nx"
37import "nx_tls13_server_session_recv_ch.nx"
38import "nx_tls13_server_session_emit_sh.nx"
39import "nx_tls13_server_session_derive_hs.nx"
40import "nx_tls13_server_session_derive_traffic.nx"
41
42func lp_eq32(a: *u8, b: *u8) -> i64 {
43 var i: i64 = 0
44 while i < 32 {
45 if a[i] != b[i] { return 0 }
46 i = i + 1
47 }
48 return 1
49}
50
51func main() -> i64 {
52 // ---- entropy (fixed: replayable row) ----
53 let cr: *u8 = sys_mmap(32)
54 let cpriv: *u8 = sys_mmap(32)
55 let sr: *u8 = sys_mmap(32)
56 let spriv: *u8 = sys_mmap(32)
57 var i: i64 = 0
58 while i < 32 {
59 cr[i] = (0x11 + i) as u8
60 cpriv[i] = (0x22 + i) as u8
61 sr[i] = (0x33 + i) as u8
62 spriv[i] = (0x44 + i) as u8
63 i = i + 1
64 }
65
66 // ---- 1. client: P-256-only ClientHello ----
67 let cs: *Tls13ClientSession = nx_tls13_client_session_new(cr, cpriv)
68 let ch_buf: *u8 = sys_mmap(1024)
69 let sni: *u8 = "nishifamily.com\x00"
70 let ch_n: i64 = tls13_client_hello_emit2(
71 cr, sni, 15, 0 as *u8, cs.p256_pub, ch_buf, 1024
72 )
73 if ch_n < 0 { return 10 }
74 nx_tls13_transcript_update(cs.transcript, ch_buf, ch_n)
75 cs.state = NX_TLS13_CSESSION_STATE_CH_SENT
76
77 // ---- 2. server: recv_ch accepts P-256 WITHOUT HRR ----
78 let ss: *Tls13ServerSession = nx_tls13_server_session_new(sr, spriv)
79 let rcv: i64 = nx_tls13_server_session_recv_ch(ss, ch_buf, ch_n)
80 if rcv == NX_TLS13_SSESSION_NEED_HRR { return 11 }
81 if rcv != NX_TLS13_SSESSION_OK { return 12 }
82 if ss.kex_group != 23 { return 13 }
83 if (ss.client_p256_pub as i64) == 0 { return 14 }
84 if ss.client_p256_pub[0] != (4 as u8) { return 15 }
85
86 // ---- 3. server: ServerHello carries secp256r1 share ----
87 let sh_buf: *u8 = sys_mmap(1024)
88 let sh_n: i64 = nx_tls13_server_session_emit_sh(ss, sh_buf, 1024)
89 if sh_n < 5 { return 16 }
90
91 // ---- 4. client: recv_sh completes P-256 side ----
92 let rsv: i64 = nx_tls13_client_session_recv_sh(cs, sh_buf + 5, sh_n - 5)
93 if rsv != NX_TLS13_RECV_SH_OK { return 17 }
94
95 // ---- 5. server: derive handshake + traffic secrets ----
96 let dhv: i64 = nx_tls13_server_session_derive_hs_secrets(ss)
97 if dhv != NX_TLS13_SSESSION_OK { return 18 }
98 let dtv: i64 = nx_tls13_server_session_derive_traffic(ss)
99 if dtv != NX_TLS13_SSESSION_OK { return 28 }
100
101 // ---- 6. THE PROOF: secrets byte-identical across roles ----
102 if (ss.client_hs_traffic_secret as i64) == 0 { return 19 }
103 if (ss.server_hs_traffic_secret as i64) == 0 { return 20 }
104 if lp_eq32(cs.client_hs_traffic_secret, ss.client_hs_traffic_secret) != 1 { return 21 }
105 if lp_eq32(cs.server_hs_traffic_secret, ss.server_hs_traffic_secret) != 1 { return 22 }
106 // Sanity: the two directions differ from each other.
107 if lp_eq32(cs.client_hs_traffic_secret, cs.server_hs_traffic_secret) == 1 { return 23 }
108
109 // ---- 7. boundary: off-curve client share rejected ----
110 let cs2: *Tls13ClientSession = nx_tls13_client_session_new(cr, cpriv)
111 let ch2: *u8 = sys_mmap(1024)
112 let ch2_n: i64 = tls13_client_hello_emit2(
113 cr, sni, 15, 0 as *u8, cs2.p256_pub, ch2, 1024
114 )
115 if ch2_n < 0 { return 24 }
116 let ss2: *Tls13ServerSession = nx_tls13_server_session_new(sr, spriv)
117 if nx_tls13_server_session_recv_ch(ss2, ch2, ch2_n) != NX_TLS13_SSESSION_OK { return 25 }
118 // Corrupt one coordinate byte AFTER capture, BEFORE derive.
119 let cp: *u8 = ss2.client_p256_pub
120 cp[10] = (cp[10] + (1 as u8)) as u8
121 let sh2: *u8 = sys_mmap(1024)
122 if nx_tls13_server_session_emit_sh(ss2, sh2, 1024) < 5 { return 26 }
123 let dh2: i64 = nx_tls13_server_session_derive_hs_secrets(ss2)
124 if dh2 != NX_TLS13_SSESSION_PROTOCOL_ERR { return 27 }
125
126 return 0
127}