admin/StarForth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase E: MINT -- real keypair, Zuse-signed DER cert, working default identity

Browse Source 
capsule_mint_identity() (new capsule_mint.h/.c): mints a fresh identity
onto a blank/unminted thumbdrive -- real Ed25519 keypair from virtio_rng,
a fresh drive_uuid (independent random draw, not derived from the
identity seed, per FABRIC-3.md §F.8 decision 3), a Zuse-signed DER cert
in the CERTVERIFY format, and a small working default personality (a
real WELCOME word, not a stub -- FABRIC-3.md §F.6/§F.8's own "default
personality content" question stays open, but whatever mints today must
actually do something when RUNCAP births it). Refuses to overwrite a
drive that already reads as a recognized home-blocks drive, mirroring
WRITE(10)'s own refuse-on-non-blank posture (decided now, not just
"reasonable by analogy" as §F.8 left it).

x509_build_user_cert() (x509_ed25519.h/.c): the encode-side counterpart
to the existing decode functions (x509_extract_ed25519_pubkey(),
x509_verify_signature(), x509_extract_serial()) -- a minimal DER TLV
writer producing exactly the fields those functions read. Host-tested
round-trip against the real decoder before trusting it in the kernel,
including a high-bit-serial case that exercises the DER integer-padding
rule; all assertions pass (pubkey/serial round-trip, signature verifies
against the real issuer, correctly rejects the wrong key and a
corrupted signature).

New user_identity_seed_t (user_identity_seed.h): the on-disk record for
a minted identity's own keypair, same magic+version+fields+pad-to-4096+
real-CRC convention as zuse_cert_devblock_t and homeblocks_sig_t. Fixed
devblock layout: sig(1), cert(2), seed record(3), default personality(4).

New MINT word (mama_forth_words.c) and a small accessor
(sk_repl_get_attached_blk_dev(), repl.h/.c) exposing the currently
attached USB device regardless of home-blocks recognition -- MINT's own
target is a blank drive, which by definition never sets Phase D's
sk_repl_get_homeblocks_dev().

Verified end-to-end live in QEMU: MINT on a genuinely blank test drive,
then (after a detach/reattach so the sig cache picks up the fresh
header -- a known workflow gap, not fixed here, flagged for whoever
builds the real Console onboarding flow) RUNCAP birthed a VM from that
drive's own newly-minted content, and VM-EXECing its WELCOME word
printed the default personality banner. The full mint-to-birth Tripod
identity flow works end to end for the first time. Clean 3-architecture
regression boot confirms no side effects on normal boot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD
This commit is contained in:
Robert Allan James
2026-08-28 14:44:59 -04:00
co-authored by Claude Sonnet 5
parent 21c143dd28
commit f6e2737f1e
13 changed files with 28317 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starkernel/crypto/x509_ed25519.c
+144
View File
@@ -219,3 +219,147 @@ int x509_extract_serial(const uint8_t *der, size_t der_len,
*serial_len_out = slen;
return 0;
}
/* ===== DER encoding (x509_build_user_cert) ===== */
/* Appends one TLV (tag + DER length + content) to *pos, advancing it.
* Short-form length only (content_len < 128) -- every field this encoder
* ever writes fits comfortably under that, so long-form length encoding
* (needed only for der_next()'s decode side, which must handle arbitrary
* real-world certs) is not needed here. Returns 0 on success, -1 if
* limit would be exceeded. */
static int der_put_tlv(uint8_t **pos, uint8_t *limit, uint8_t tag,
const uint8_t *content, size_t content_len) {
if (content_len >= 128) return -1; /* short-form only, by construction */
if ((size_t)(limit - *pos) < 2 + content_len) return -1;
*(*pos)++ = tag;
*(*pos)++ = (uint8_t)content_len;
if (content_len) memcpy(*pos, content, content_len);
*pos += content_len;
return 0;
}
/* Ed25519 AlgorithmIdentifier ::= SEQUENCE { OID 1.3.101.112 } (no
* parameters) -- same bytes x509_extract_ed25519_pubkey()/
* x509_verify_signature() both already recognize. */
static int der_put_ed25519_algid(uint8_t **pos, uint8_t *limit) {
static const uint8_t ED25519_OID[3] = { 0x2B, 0x65, 0x70 };
uint8_t oid_tlv[5];
uint8_t *p = oid_tlv;
if (der_put_tlv(&p, oid_tlv + sizeof(oid_tlv), 0x06,
ED25519_OID, sizeof(ED25519_OID)) != 0) return -1;
return der_put_tlv(pos, limit, 0x30, oid_tlv, (size_t)(p - oid_tlv));
}
/* INTEGER-encode a fixed-size unsigned value: prepend a single 0x00 pad
* byte if the high bit would otherwise make it read as a negative DER
* INTEGER (mirrors x509_extract_serial()'s own strip-a-leading-pad
* logic, in reverse). */
static int der_put_uint_integer(uint8_t **pos, uint8_t *limit,
const uint8_t *val, size_t val_len) {
uint8_t buf[24];
size_t n = 0;
if (val_len + 1 > sizeof(buf)) return -1;
if (val[0] & 0x80u) buf[n++] = 0x00;
memcpy(buf + n, val, val_len);
n += val_len;
return der_put_tlv(pos, limit, 0x02, buf, n);
}
size_t x509_build_user_cert(uint8_t *out, size_t out_cap,
const uint8_t subject_pubkey[32],
const uint8_t serial[16],
const uint8_t issuer_seed[32]) {
if (!out || !subject_pubkey || !serial || !issuer_seed) return 0;
uint8_t tbs_content[192];
uint8_t *tp = tbs_content;
uint8_t *tlim = tbs_content + sizeof(tbs_content);
/* serialNumber */
if (der_put_uint_integer(&tp, tlim, serial, 16) != 0) return 0;
/* signature (AlgorithmIdentifier) */
if (der_put_ed25519_algid(&tp, tlim) != 0) return 0;
/* issuer, validity, subject -- each an empty SEQUENCE; the decode
* side only ever skips these three fields by length, never reads
* their content (x509_extract_ed25519_pubkey()'s own comment). */
if (der_put_tlv(&tp, tlim, 0x30, (const uint8_t *)0, 0) != 0) return 0;
if (der_put_tlv(&tp, tlim, 0x30, (const uint8_t *)0, 0) != 0) return 0;
if (der_put_tlv(&tp, tlim, 0x30, (const uint8_t *)0, 0) != 0) return 0;
/* subjectPublicKeyInfo ::= SEQUENCE { algorithm, subjectPublicKey } */
{
uint8_t spki[48];
uint8_t *sp = spki;
uint8_t *slim = spki + sizeof(spki);
if (der_put_ed25519_algid(&sp, slim) != 0) return 0;
uint8_t bitstr[33];
bitstr[0] = 0x00; /* unused-bits */
memcpy(bitstr + 1, subject_pubkey, 32);
if (der_put_tlv(&sp, slim, 0x03, bitstr, sizeof(bitstr)) != 0) return 0;
if (der_put_tlv(&tp, tlim, 0x30, spki, (size_t)(sp - spki)) != 0) return 0;
}
size_t tbs_len = (size_t)(tp - tbs_content);
/* tbsCertificate's own full TLV bytes (tag+length+content) -- what
* Ed25519 actually signs, matching x509_verify_signature()'s own
* tbs_raw framing exactly. tbs_len < 128 is a safe assumption for
* every field set above, but tbsCertificate as a whole (~150+ bytes)
* needs long-form length -- built by hand here rather than reusing
* der_put_tlv()'s short-form-only helper. */
uint8_t tbs_full[4 + sizeof(tbs_content)];
size_t tbs_full_len;
if (tbs_len < 128) {
tbs_full[0] = 0x30;
tbs_full[1] = (uint8_t)tbs_len;
memcpy(tbs_full + 2, tbs_content, tbs_len);
tbs_full_len = 2 + tbs_len;
} else {
tbs_full[0] = 0x30;
tbs_full[1] = 0x81; /* long-form, 1 length byte follows */
tbs_full[2] = (uint8_t)tbs_len;
memcpy(tbs_full + 3, tbs_content, tbs_len);
tbs_full_len = 3 + tbs_len;
}
uint8_t sig[64];
ed25519_sign(issuer_seed, tbs_full, tbs_full_len, sig);
uint8_t cert_content[4 + sizeof(tbs_full) + 8 + 68];
uint8_t *cp = cert_content;
uint8_t *clim = cert_content + sizeof(cert_content);
if ((size_t)(clim - cp) < tbs_full_len) return 0;
memcpy(cp, tbs_full, tbs_full_len);
cp += tbs_full_len;
if (der_put_ed25519_algid(&cp, clim) != 0) return 0;
{
uint8_t sigbitstr[65];
sigbitstr[0] = 0x00;
memcpy(sigbitstr + 1, sig, 64);
/* BIT STRING content is 65 bytes >= 128-threshold's neighbor --
* still short-form (65 < 128), der_put_tlv() handles it directly. */
if (der_put_tlv(&cp, clim, 0x03, sigbitstr, sizeof(sigbitstr)) != 0) return 0;
}
size_t cert_content_len = (size_t)(cp - cert_content);
/* Outer Certificate ::= SEQUENCE { ... } -- needs long-form length too. */
if (cert_content_len < 128) {
if (out_cap < 2 + cert_content_len) return 0;
out[0] = 0x30;
out[1] = (uint8_t)cert_content_len;
memcpy(out + 2, cert_content, cert_content_len);
return 2 + cert_content_len;
} else if (cert_content_len < 256) {
if (out_cap < 3 + cert_content_len) return 0;
out[0] = 0x30;
out[1] = 0x81;
out[2] = (uint8_t)cert_content_len;
memcpy(out + 3, cert_content, cert_content_len);
return 3 + cert_content_len;
}
return 0; /* every real field set above stays well under 256 total */
}