nx_x509_verify_rsa_pkcs1_sha256.nx source
↩ module page · 55 lines · 2141 B
1// nx_x509_verify_rsa_pkcs1_sha256.nx -- X.509 outer-signature verify
2// for sha256WithRSAEncryption signed certs.
3//
4// Parallel to nx_x509_verify_ecdsa.nx + nx_x509_verify_ecdsa_p384.nx.
5// Composes nx_rsa_pkcs1_v1_5_sha256 with cert.tbs / cert.sig byte
6// ranges.
7//
8// API:
9// nx_x509_verify_rsa_pkcs1_sha256(tbs, tbs_len, sig, sig_len,
10// issuer_n_2048, issuer_e) -> verdict
11//
12// Sealed verdict mirrors other verify wrappers' shape (OK=1, fail=others).
13//
14// license_tier: INDEPENDENT_REDERIVE
15// genealogy_id: international-research-sources/ietf/rfc_5280 + rfc_8017
16// lineage_id: nishi_x509_verify_rsa_pkcs1_sha256_q10
17
18// nx_safety_envelope:
19// intended_use: AUTO_APPLIED -- primitive-specific tuning queued
20// sil_target: SIL2
21// evidence: [bulk_applied_2026-05-20, x509-outer-rsa-sha256]
22// verdict: NOT_YET_EVALUATED
23
24import "nx_syscalls.nx"
25import "nx_u2048.nx"
26import "nx_rsa_pkcs1_v1_5_sha256.nx"
27
28const NX_X509_RSA_PKCS1_SHA256_OK: i64 = 1
29const NX_X509_RSA_PKCS1_SHA256_BAD_LEN: i64 = 2
30const NX_X509_RSA_PKCS1_SHA256_BAD_SIG: i64 = 3
31const NX_X509_RSA_PKCS1_SHA256_BAD_PUB: i64 = 4
32const NX_X509_RSA_PKCS1_SHA256_VERDICT_N: i64 = 5
33
34func nx_x509_rsa_pkcs1_sha256_verdict_is_valid(v: i64) -> i64 {
35 if v < NX_X509_RSA_PKCS1_SHA256_OK { return 0 }
36 if v >= NX_X509_RSA_PKCS1_SHA256_VERDICT_N { return 0 }
37 return 1
38}
39
40func nx_x509_verify_rsa_pkcs1_sha256(tbs: *u8, tbs_len: i64,
41 sig: *u8, sig_len: i64,
42 pub_n: *i64, pub_e: i64) -> i64 {
43 // RSA-2048 signatures are exactly 256 bytes (after the BIT STRING
44 // unused-bits byte is stripped by x509_parse).
45 if sig_len != 256 { return NX_X509_RSA_PKCS1_SHA256_BAD_LEN }
46
47 let v: i64 = rsa_pkcs1_v1_5_sha256_verify(tbs, tbs_len, sig, pub_n, pub_e)
48 if v == NX_RSA_PKCS1_V15_OK { return NX_X509_RSA_PKCS1_SHA256_OK }
49 if v == NX_RSA_PKCS1_V15_S_OUT_OF_RANGE { return NX_X509_RSA_PKCS1_SHA256_BAD_PUB }
50 return NX_X509_RSA_PKCS1_SHA256_BAD_SIG
51}
52
53func main() -> i64 {
54 return 0
55}