`nx_token.nx` source

1// nx_token.nx -- CMS layered-spec task #3 (L3-crypto, lowest BUILD): a secure random token for session IDs and
2// CSRF tokens. Grounded (deep-research wpq1btr1l, OWASP/NIST primary): session IDs need >=64 bits of CSPRNG
3// entropy, CSRF synchronizer tokens >=128 bits, generated by a CSPRNG. We read the kernel CSPRNG (/dev/urandom)
4// -- NOT a fast PRNG -- and hex-encode. 16 bytes = 128 bits (covers both). Bottom-up: L0 file read -> L3 token.
5// Built by the team; Engineer gate = the property test below (length + uniqueness + non-degenerate). Hands a
6// tested deliverable UP to L7 (cookie/session) and the CSRF binder. license_tier: ORIGINAL
7import "nx_syscalls.nx"
8
9func tk_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
10
11func hexc(v: i64) -> u8 { if v < 10 { return (48 + v) as u8 } return (97 + (v - 10)) as u8 }
12
13// fill `out` with 2*nbytes hex chars from the kernel CSPRNG; NUL-terminate; return char count (0 on failure).
14func sec_token(out: *u8, nbytes: i64) -> i64 {
15    let fd: i64 = sys_openat_rd("/dev/urandom" as *u8, 0)
16    if fd < 0 { return 0 }
17    let raw: *u8 = sys_mmap(nbytes + 8)
18    let got: i64 = sys_read(fd, raw, nbytes)
19    sys_close(fd)
20    if got != nbytes { return 0 }
21    var i: i64 = 0; var o: i64 = 0
22    while i < nbytes {
23        let byte: i64 = raw[i] as i64
24        out[o] = hexc((byte >> 4) & 0xf); out[o + 1] = hexc(byte & 0xf)
25        o = o + 2; i = i + 1
26    }
27    out[o] = 0 as u8
28    return o
29}
30
31func main() -> i64 {
32    let t1: *u8 = sys_mmap(64); let t2: *u8 = sys_mmap(64)
33    let n1: i64 = sec_token(t1, 16)    // 128-bit session/CSRF token
34    let n2: i64 = sec_token(t2, 16)
35
36    tk_puts("=== nx_token (L3 secure-token) self-test ===\n" as *u8)
37    tk_puts("token1 = " as *u8); tk_puts(t1); tk_puts("\n" as *u8)
38    tk_puts("token2 = " as *u8); tk_puts(t2); tk_puts("\n" as *u8)
39
40    // property gate: both 32 hex chars (128 bits), differ, and not degenerate (not all-zero / not all-same char).
41    var pass: i64 = 1
42    if n1 != 32 { pass = 0 }
43    if n2 != 32 { pass = 0 }
44    var diffs: i64 = 0; var i: i64 = 0
45    while i < 32 { if t1[i] != t2[i] { diffs = diffs + 1 } i = i + 1 }
46    if diffs == 0 { pass = 0 }                       // two CSPRNG draws must differ
47    var nonzero: i64 = 0; i = 0
48    while i < 32 { if t1[i] != (48 as u8) { nonzero = 1 } i = i + 1 }
49    if nonzero == 0 { pass = 0 }                     // not all '0' (degenerate)
50
51    tk_puts("len1=32? " as *u8); if n1==32 { tk_puts("Y " as *u8) } else { tk_puts("N " as *u8) }
52    tk_puts(" len2=32? " as *u8); if n2==32 { tk_puts("Y " as *u8) } else { tk_puts("N " as *u8) }
53    tk_puts(" distinct-chars(t1 vs t2)=" as *u8)
54    let db: *u8 = sys_mmap(8); var m: i64=diffs; var k: i64=0; if m==0{db[0]=48 as u8;k=1}; while m>0{db[k]=(48+(m%10)) as u8;m=m/10;k=k+1}
55    var j: i64=0; let rev: *u8 = sys_mmap(8); while j<k { rev[j]=db[k-1-j]; j=j+1 }
56    sys_write(1, rev, k)
57    tk_puts("\n" as *u8)
58    if pass == 1 { tk_puts(">>> nx_token GATE PASS (128-bit CSPRNG token; ready for L7 session+CSRF)\n" as *u8); sys_exit(0); return 0 }
59    tk_puts(">>> nx_token GATE FAIL\n" as *u8); sys_exit(1); return 1
60}
nx_token.nx source

`nx_token.nx` source
