Robert Allan JamesandClaude Sonnet 5
b031b802e3
FABRIC.md -> FABRIC-0.md FABRIC-2.md -> FABRIC-1.md FABRIC-3.md -> FABRIC-2.md (the current/living document) FABRIC-4.md unchanged (new #3 to follow separately) Every cross-reference repo-wide updated to match, including doc-comment citations inside kernel source (.c/.h) files -- done via an ordered placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md-> placeholder1, FABRIC.md->placeholder0, then placeholders resolved to final names) in a single pass per file to avoid double-shifting already-renamed references. One line in capsules/font.4th grew past the 64-char block-format limit as a side effect of the longer filename; shortened it and reverified with mkcapsule --lint (34/34 pass) before rebuilding. Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the foreground) after the fix; logs and DoE CSVs from this session's verification runs included per this repo's own audit-artifact convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var
95 lines
4.9 KiB
C
95 lines
4.9 KiB
C
/*
|
|
* x509_ed25519.h -- minimal, targeted DER walkers for Ed25519-signed X.509
|
|
* certificates (RFC 8410). Deliberately NOT a general ASN.1/X.509 parser
|
|
* (Milestone 6 decision, FABRIC-1.md): each function walks exactly as far
|
|
* into the DER structure as its own job needs, nothing more.
|
|
*
|
|
* x509_extract_ed25519_pubkey() only ever reads SubjectPublicKeyInfo --
|
|
* no signature verification, no chain validation, no extension parsing.
|
|
* That's the capsule-PKI use case (Milestone 6): the embedded snakeoil
|
|
* intermediate cert is trusted because it's baked into the trusted build,
|
|
* never re-verified against the offline root CA at boot.
|
|
*
|
|
* x509_verify_signature()/x509_extract_serial() (added 2026-08-28,
|
|
* FABRIC-2.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
|
|
* which unlike the capsule-PKI chain is signed by Zuse's own on-device
|
|
* key and genuinely needs its signature checked at attach time, not just
|
|
* trusted by embedding. Two separate trust roots, two separate reasons
|
|
* to exist in the same small file (shared DER-walking internals only).
|
|
*
|
|
* Freestanding C99, no libc beyond memcmp/memcpy (already provided by
|
|
* src/starkernel/vm/host/shim.c in the kernel build).
|
|
*/
|
|
#ifndef STARKERNEL_X509_ED25519_H
|
|
#define STARKERNEL_X509_ED25519_H
|
|
|
|
#include <stdint.h>
|
|
#include <stddef.h>
|
|
|
|
/* Returns 0 on success (pubkey_out[32] filled), -1 on any malformed
|
|
* encoding, unexpected structure, or non-Ed25519 algorithm. Never
|
|
* faults on malformed input -- every DER length/tag is bounds-checked
|
|
* against der_len before use. */
|
|
int x509_extract_ed25519_pubkey(const uint8_t *der, size_t der_len,
|
|
uint8_t pubkey_out[32]);
|
|
|
|
/* Verify a DER-encoded certificate's own outer Ed25519 signature (the
|
|
* signatureValue field) was produced by issuer_pubkey signing the raw,
|
|
* exactly-as-encoded tbsCertificate bytes (DER signs the octets, not a
|
|
* re-derived hash of "the fields" -- the TLV framing is part of what's
|
|
* signed). Rejects a non-Ed25519 signatureAlgorithm rather than guessing.
|
|
*
|
|
* Returns 0 if the signature verifies, -1 on any malformed encoding,
|
|
* unexpected structure, non-Ed25519 signature algorithm, or a signature
|
|
* that does not verify. Never faults on malformed input. */
|
|
int x509_verify_signature(const uint8_t *der, size_t der_len,
|
|
const uint8_t issuer_pubkey[32]);
|
|
|
|
/* Extract the raw serialNumber INTEGER content bytes from a DER-encoded
|
|
* certificate's tbsCertificate. A single leading 0x00 pad byte (DER adds
|
|
* one when the value's high bit would otherwise read as a negative
|
|
* INTEGER) is stripped before copying, so a 16-byte drive_uuid compares
|
|
* byte-for-byte regardless of whether DER happened to pad it.
|
|
*
|
|
* @param serial_out Caller-provided buffer.
|
|
* @param serial_out_cap Its size in bytes; returns -1 if the real
|
|
* (pad-stripped) serial is larger than this.
|
|
* @param serial_len_out Set to the real length actually copied.
|
|
* @return 0 on success, -1 on any malformed encoding or unexpected
|
|
* structure. Never faults on malformed input. */
|
|
int x509_extract_serial(const uint8_t *der, size_t der_len,
|
|
uint8_t *serial_out, size_t serial_out_cap,
|
|
size_t *serial_len_out);
|
|
|
|
/*
|
|
* x509_build_user_cert (added 2026-08-28, FABRIC-2.md §F.8/§F.19, MINT):
|
|
* the encode-side counterpart to x509_verify_signature()/x509_extract_*
|
|
* above. Builds a minimal DER-encoded X.509 certificate exercising
|
|
* exactly the fields those functions read -- serialNumber, an Ed25519
|
|
* SubjectPublicKeyInfo, an Ed25519-signed signatureValue -- and nothing
|
|
* else. issuer/validity/subject are each encoded as an empty SEQUENCE
|
|
* (valid, zero-length DER TLVs the decode side only ever skips, never
|
|
* reads the content of); version is omitted entirely (implicit v1,
|
|
* matching the decode side's own optional-version handling). This is
|
|
* deliberately not a general-purpose X.509 builder -- same scope
|
|
* discipline as the decode side's own doc comment above.
|
|
*
|
|
* @param out Caller-provided output buffer.
|
|
* @param out_cap Its size in bytes.
|
|
* @param subject_pubkey The new identity's own Ed25519 public key --
|
|
* becomes the cert's SubjectPublicKeyInfo.
|
|
* @param serial 16 bytes -- becomes the cert's serialNumber
|
|
* (CERTVERIFY/BINDSTEP compare this against
|
|
* homeblocks_sig_t.drive_uuid).
|
|
* @param issuer_seed The signer's own Ed25519 seed (Zuse's
|
|
* vm->zuse_cert_seed) -- signs the resulting
|
|
* tbsCertificate bytes.
|
|
* @return Number of bytes written to out, or 0 if out_cap was too small.
|
|
*/
|
|
size_t x509_build_user_cert(uint8_t *out, size_t out_cap,
|
|
const uint8_t subject_pubkey[32],
|
|
const uint8_t serial[16],
|
|
const uint8_t issuer_seed[32]);
|
|
|
|
#endif /* STARKERNEL_X509_ED25519_H */
|