code wiki / _hdl_build / nx_vault_dynamic_test.nx
`nx_vault_dynamic_test.nx` source

1// nx_vault_dynamic_test.nx -- DYNGATE: proves dynamic secrets. GREEN iff: two issues yield DISTINCT creds;
2// the issued cred is valid within its ttl and AUTO-EXPIRES after (lease-bound); revoke invalidates
3// immediately; the generator is reproducible (deterministic for replay) AND depends on both seed and role
4// (so creds aren't guessable from the counter alone). exit 0 on 7/7.
5import "nx_vault_dynamic.nx"
6import "nx_syscalls.nx"
7
8func dg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
9func dg_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 }
10
11func main() -> i64 {
12    dg_puts("=== SOVEREIGN DYNAMIC SECRETS (generate-on-demand, lease-bound) ===\n" as *u8)
13    let role: i64 = 42
14    let role2: i64 = 99
15    let seed: i64 = 51966           // 0xCAFE
16    let seed2: i64 = 48879          // 0xBEEF
17
18    let cred0: i64 = dyn_gen_cred(role, 0, seed)
19    let cred1: i64 = dyn_gen_cred(role, 1, seed)
20    let cred0b: i64 = dyn_gen_cred(role, 0, seed)        // reproduce same inputs
21    let cred0_seed2: i64 = dyn_gen_cred(role, 0, seed2)  // different seed
22    let cred0_role2: i64 = dyn_gen_cred(role2, 0, seed)  // different role
23
24    // lease for the issued cred: issued at 1000, ttl 60, max_ttl 120
25    let v_mid: i64 = dyn_valid(1030, 1000, 60, 0)        // within ttl
26    let v_exp: i64 = dyn_valid(1100, 1000, 60, 0)        // after ttl -> auto-expired
27    let v_rev: i64 = dyn_valid(1030, 1000, 60, 1)        // revoked -> invalid despite time
28    let rem:   i64 = dyn_remaining(1030, 1000, 60, 0)    // 30 left
29
30    dg_puts(" cred0!=cred1: " as *u8); dg_num(cred0); dg_puts(" / " as *u8); dg_num(cred1); dg_puts("\n" as *u8)
31    dg_puts(" valid@1030=" as *u8); dg_num(v_mid); dg_puts(" expired@1100=" as *u8); dg_num(v_exp)
32    dg_puts(" valid-when-revoked=" as *u8); dg_num(v_rev); dg_puts(" remaining@1030=" as *u8); dg_num(rem); dg_puts("\n" as *u8)
33
34    let r: *i64 = sys_mmap(8*8) as *i64
35    r[0] = 0; if cred0 != cred1 { r[0] = 1 }                 // distinct per issue
36    r[1] = 0; if v_mid == 1 { r[1] = 1 }                     // valid within ttl
37    r[2] = 0; if v_exp == 0 { r[2] = 1 }                     // auto-expires (lease-bound)
38    r[3] = 0; if v_rev == 0 { r[3] = 1 }                     // revoke invalidates immediately
39    r[4] = 0; if cred0b == cred0 { r[4] = 1 }                // reproducible (deterministic for replay)
40    r[5] = 0; if cred0_seed2 != cred0 { r[5] = 1 }           // seed-dependent (not counter-guessable)
41    r[6] = 0; if cred0_role2 != cred0 { if rem == 30 { r[6] = 1 } }  // role-dependent + remaining correct
42
43    var pass: i64 = 0; var i: i64 = 0
44    while i < 7 { pass = pass + r[i]; i = i + 1 }
45    dg_puts("----\n passed " as *u8); dg_num(pass); dg_puts("/7\n" as *u8)
46    if pass == 7 {
47        dg_puts("DYNGATE distinct_per_issue=1 lease_bound_auto_expiry=1 revoke_immediate=1 reproducible=1 seed_role_dependent=1 exceed[sovereign generate-on-demand short-lived creds = HashiCorp dynamic-secrets-class; leak bounded to one lease; prod generator = CSPRNG] verdict=GREEN\n" as *u8)
48        sys_exit(0); return 0
49    }
50    dg_puts("DYNGATE verdict=RED\n" as *u8); sys_exit(1); return 1
51}
nx_vault_dynamic_test.nx source

`nx_vault_dynamic_test.nx` source
