nx_x509_pubkey_ed.nx source

1// nx_x509_pubkey_ed.nx -- extract a 32-byte Ed25519 public key from 2// an X.509 SubjectPublicKeyInfo. 3// 4// Phase 0b §I.4 piece 5a of the chain-walker arc. Trivial parallel 5// to nx_x509_pubkey_ec.nx -- Ed25519 BIT STRING content is just 6// the 32 raw pubkey bytes (RFC 8410 §4 -- no leading indicator, 7// no compressed/uncompressed split). 8// 9// x509_parse already strips the BIT STRING's "unused bits" prefix 10// byte, so cert.pubkey_off points at the first key byte and 11// cert.pubkey_len == 32 for an Ed25519 key. 12// 13// Public API: 14// nx_x509_pubkey_extract_ed25519(buf, cert, out_32) -> verdict 15// nx_x509_pubkey_ed_verdict_is_valid(v) -> 0|1 16// 17// Sealed verdict: 18// NX_X509_PUBKEY_ED_OK 32 bytes copied 19// NX_X509_PUBKEY_ED_BAD_LEN pubkey_len != 32 20// 21// Per Cardinals 9 (single-responsibility -- extract, not verify or 22// alg-identify) and 12 (defensive at boundaries -- length check). 23// 24// license_tier: INDEPENDENT_REDERIVE 25// genealogy_id: international-research-sources/ietf/rfc_8410 26// lineage_id: nishi_x509_pubkey_ed25519_q10 27 28// nx_safety_envelope: 29// intended_use: AUTO_APPLIED -- primitive-specific tuning queued 30// sil_target: SIL1 31// evidence: [bulk_applied_2026-05-19, x509-ed25519-pubkey-extract] 32// verdict: NOT_YET_EVALUATED 33 34import "nx_syscalls.nx" 35import "nx_x509.nx" 36 37const NX_X509_PUBKEY_ED_OK: i64 = 1 38const NX_X509_PUBKEY_ED_BAD_LEN: i64 = 2 39const NX_X509_PUBKEY_ED_VERDICT_N: i64 = 3 40 41func nx_x509_pubkey_ed_verdict_is_valid(v: i64) -> i64 { 42 if v < NX_X509_PUBKEY_ED_OK { return 0 } 43 if v >= NX_X509_PUBKEY_ED_VERDICT_N { return 0 } 44 return 1 45} 46 47// Copy the 32-byte Ed25519 pubkey from buf[cert.pubkey_off ..] into 48// out_32 (caller-allocated 32-byte buffer). 49func nx_x509_pubkey_extract_ed25519(buf: *u8, cert: *X509Cert, 50 out_32: *u8) -> i64 { 51 if cert.pubkey_len != 32 { return NX_X509_PUBKEY_ED_BAD_LEN } 52 var i: i64 = 0 53 while i < 32 { 54 out_32[i] = buf[cert.pubkey_off + i] 55 i = i + 1 56 } 57 return NX_X509_PUBKEY_ED_OK 58} 59 60// Compile-only smoke. 61func main() -> i64 { 62 return 0 63}