nx_x509_verify_rsa_pkcs1_sha256_4096.nx source
↩ module page · 49 lines · 2029 B
1// nx_x509_verify_rsa_pkcs1_sha256_4096.nx -- X.509 outer-signature
2// verify for sha256WithRSAEncryption signed certs with RSA-4096 keys.
3//
4// Parallel to nx_x509_verify_rsa_pkcs1_sha256.nx (2048 variant).
5// Composes nx_rsa_pkcs1_v1_5_sha256_4096 with cert.tbs / cert.sig
6// byte ranges.
7//
8// API:
9// nx_x509_verify_rsa_pkcs1_sha256_4096(tbs, tbs_len, sig, sig_len,
10// issuer_n_4096, issuer_e) -> verdict
11//
12// Sealed verdict mirrors the 2048 variant shape (OK=1, fails=others).
13//
14// license_tier: INDEPENDENT_REDERIVE
15// genealogy_id: international-research-sources/ietf/rfc_5280 + rfc_8017
16// lineage_id: nishi_x509_verify_rsa_pkcs1_sha256_4096_q1
17
18import "nx_syscalls.nx"
19import "nx_u4096.nx"
20import "nx_rsa_pkcs1_v1_5_sha256_4096.nx"
21
22const NX_X509_RSA_PKCS1_SHA256_4096_OK: i64 = 1
23const NX_X509_RSA_PKCS1_SHA256_4096_BAD_LEN: i64 = 2
24const NX_X509_RSA_PKCS1_SHA256_4096_BAD_SIG: i64 = 3
25const NX_X509_RSA_PKCS1_SHA256_4096_BAD_PUB: i64 = 4
26const NX_X509_RSA_PKCS1_SHA256_4096_VERDICT_N: i64 = 5
27
28func nx_x509_rsa_pkcs1_sha256_4096_verdict_is_valid(v: i64) -> i64 {
29 if v < NX_X509_RSA_PKCS1_SHA256_4096_OK { return 0 }
30 if v >= NX_X509_RSA_PKCS1_SHA256_4096_VERDICT_N { return 0 }
31 return 1
32}
33
34func nx_x509_verify_rsa_pkcs1_sha256_4096(tbs: *u8, tbs_len: i64,
35 sig: *u8, sig_len: i64,
36 pub_n: *i64, pub_e: i64) -> i64 {
37 // RSA-4096 signatures are exactly 512 bytes (after the BIT STRING
38 // unused-bits byte is stripped by x509_parse).
39 if sig_len != 512 { return NX_X509_RSA_PKCS1_SHA256_4096_BAD_LEN }
40
41 let v: i64 = rsa_pkcs1_v1_5_sha256_4096_verify(tbs, tbs_len, sig, pub_n, pub_e)
42 if v == NX_RSA_PKCS1_V15_4096_OK { return NX_X509_RSA_PKCS1_SHA256_4096_OK }
43 if v == NX_RSA_PKCS1_V15_4096_S_OUT_OF_RANGE { return NX_X509_RSA_PKCS1_SHA256_4096_BAD_PUB }
44 return NX_X509_RSA_PKCS1_SHA256_4096_BAD_SIG
45}
46
47func main() -> i64 {
48 return 0
49}