nx_vault_shamir_test.nx source

1// nx_vault_shamir_test.nx -- SHAMIRGATE: proves K-of-N threshold unseal. Split secret into N=5 shares with 2// threshold K=3 (degree-2 poly). GREEN iff: ANY 3 distinct shares reconstruct the EXACT secret; K-1 (2) 3// shares reconstruct a WRONG value (no quorum -> no unseal); a corrupted share yields a WRONG secret 4// (integrity must be checked separately -- Shamir alone doesn't detect it, stated honestly); shares are 5// distinct and nonzero. exit 0 on 7/7. 6import "nx_vault_shamir.nx" 7import "nx_syscalls.nx" 8 9func sg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 10func sg_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 } 11 12func sg_recon3(x0: i64, x1: i64, x2: i64, y0: i64, y1: i64, y2: i64) -> i64 { 13 let xs: *i64 = sys_mmap(24) as *i64 14 let ys: *i64 = sys_mmap(24) as *i64 15 xs[0]=x0; xs[1]=x1; xs[2]=x2; ys[0]=y0; ys[1]=y1; ys[2]=y2 16 return sh_reconstruct(xs, ys, 3) 17} 18func sg_recon2(x0: i64, x1: i64, y0: i64, y1: i64) -> i64 { 19 let xs: *i64 = sys_mmap(16) as *i64 20 let ys: *i64 = sys_mmap(16) as *i64 21 xs[0]=x0; xs[1]=x1; ys[0]=y0; ys[1]=y1 22 return sh_reconstruct(xs, ys, 2) 23} 24 25func main() -> i64 { 26 sg_puts("=== SOVEREIGN SHAMIR K-of-N THRESHOLD UNSEAL (GF(2^31-1)) ===\n" as *u8) 27 let secret: i64 = 1234567 28 let coeffs: *i64 = sys_mmap(24) as *i64 29 coeffs[0] = secret; coeffs[1] = 111; coeffs[2] = 222 // K=3 -> degree-2 poly 30 31 let y1: i64 = sh_eval(coeffs, 3, 1) 32 let y2: i64 = sh_eval(coeffs, 3, 2) 33 let y3: i64 = sh_eval(coeffs, 3, 3) 34 let y4: i64 = sh_eval(coeffs, 3, 4) 35 let y5: i64 = sh_eval(coeffs, 3, 5) 36 37 let s_123: i64 = sg_recon3(1, 2, 3, y1, y2, y3) 38 let s_245: i64 = sg_recon3(2, 4, 5, y2, y4, y5) 39 let s_135: i64 = sg_recon3(1, 3, 5, y1, y3, y5) 40 let s_345: i64 = sg_recon3(3, 4, 5, y3, y4, y5) 41 let s_2only: i64 = sg_recon2(1, 2, y1, y2) // K-1 shares -> wrong 42 let s_corrupt: i64 = sg_recon3(1, 2, 3, y1, sh_add(y2, 1), y3) // a tampered share -> wrong 43 44 sg_puts(" secret=" as *u8); sg_num(secret); sg_puts(" | {1,2,3}=" as *u8); sg_num(s_123) 45 sg_puts(" {2,4,5}=" as *u8); sg_num(s_245); sg_puts(" {1,3,5}=" as *u8); sg_num(s_135) 46 sg_puts(" | 2-shares=" as *u8); sg_num(s_2only); sg_puts(" corrupt=" as *u8); sg_num(s_corrupt); sg_puts("\n" as *u8) 47 48 var distinct: i64 = 1 49 if y1 == y2 { distinct = 0 } 50 if y1 == y3 { distinct = 0 } 51 if y2 == y3 { distinct = 0 } 52 if y4 == y5 { distinct = 0 } 53 var nonzero: i64 = 1 54 if y1 == 0 { nonzero = 0 } 55 if y5 == 0 { nonzero = 0 } 56 57 let r: *i64 = sys_mmap(8*8) as *i64 58 r[0] = 0; if s_123 == secret { r[0] = 1 } // any K reconstructs 59 r[1] = 0; if s_245 == secret { r[1] = 1 } // a different K-subset 60 r[2] = 0; if s_135 == secret { r[2] = 1 } // another K-subset 61 r[3] = 0; if s_345 == secret { r[3] = 1 } // a 4th K-subset 62 r[4] = 0; if s_2only != secret { r[4] = 1 } // K-1 -> NO unseal (wrong value) 63 r[5] = 0; if s_corrupt != secret { r[5] = 1 } // corrupted share -> wrong secret 64 r[6] = 0; if distinct == 1 { if nonzero == 1 { r[6] = 1 } } // shares distinct + nonzero 65 66 var pass: i64 = 0; var i: i64 = 0 67 while i < 7 { pass = pass + r[i]; i = i + 1 } 68 sg_puts("----\n passed " as *u8); sg_num(pass); sg_puts("/7\n" as *u8) 69 if pass == 7 { 70 sg_puts("SHAMIRGATE field=GF(2^31-1) N=5 K=3 any_k_reconstructs=1 k_minus_1_fails=1 corrupt_share_wrong=1 exceed[sovereign multi-operator threshold unseal = HashiCorp Shamir-seal-class; real Lagrange over a prime field, no overflow; integrity = separate concern, stated honestly] verdict=GREEN\n" as *u8) 71 sys_exit(0); return 0 72 } 73 sg_puts("SHAMIRGATE verdict=RED\n" as *u8); sys_exit(1); return 1 74}