code wiki / _hdl_build / nx_vault_dynamic.nx
nx_vault_dynamic.nx source
↩ module page · 30 lines · 1749 B
1// nx_vault_dynamic.nx -- sovereign DYNAMIC SECRETS (HashiCorp Vault "dynamic secrets engines" gap from
2// vault_capability_census.tsv). Instead of storing a long-lived credential, the vault GENERATES a fresh,
3// short-lived credential on demand, bound to a LEASE (composes nx_vault_lease): it auto-expires and is
4// revocable. Each issue yields a DISTINCT credential -> a leak is bounded to one short-lived cred, not the
5// master. The generator is deterministic here (gate/replay); PRODUCTION pulls from the CSPRNG. ORIGINAL.
6import "nx_vault_lease.nx"
7import "nx_syscalls.nx"
8const K_MAGIC_7919: i64 = 7919
9const K_MAGIC_104729: i64 = 104729
10const K_MAGIC_2654435761: i64 = 2654435761
11const K_MAGIC_2246822519: i64 = 2246822519
12
13// generate-on-demand credential: distinct per (role, counter) and dependent on a secret seed. splitmix-style
14// integer mix with literal-safe (<2^32) constants. NOT a crypto-RNG -- production swaps in the CSPRNG; the
15// property the gate proves is distinctness + seed/role dependence + reproducibility.
16func dyn_gen_cred(role: i64, counter: i64, seed: i64) -> i64 {
17 var x: i64 = seed + role * K_MAGIC_7919 + counter * K_MAGIC_104729
18 x = x * K_MAGIC_2654435761
19 x = x ^ (x >> 16)
20 x = x * K_MAGIC_2246822519
21 x = x ^ (x >> 13)
22 if x < 0 { x = 0 - x }
23 return x
24}
25
26// the dynamic credential is valid only while its lease is valid (auto-expiry + revoke). composes lease.
27func dyn_valid(now: i64, issued_at: i64, ttl: i64, revoked: i64) -> i64 { return lease_valid(now, issued_at, ttl, revoked) }
28
29// seconds the issued credential has left (0 if expired/revoked).
30func dyn_remaining(now: i64, issued_at: i64, ttl: i64, revoked: i64) -> i64 { return lease_remaining(now, issued_at, ttl, revoked) }