Redmagic

Redmagic is the Lux system standard library for Yggdrasil. cargo xtask watch in the sibling yggdrasil repository compiles the programs in programs/ with the sibling lux compiler and packs their content-addressed functions into the Yggdrasil disk image.

The programs currently provide:

• Yggdrasil port, TCP/IP, TCP REPL, ANSI terminal, and GPU examples
• reusable grayscale font (use font), virtio-gpu 2D transport (use gpu), and virgl 3D encoders (use virgl)
• a one-record-per-sector disk key/value codec and block-port adapter
• a secure-random adapter backed only by the kernel CSPRNG port
• pure-Lux SHA-256, HMAC, HKDF, ChaCha20, Poly1305, and ChaCha20-Poly1305
• pure-Lux TLS 1.3 client and server state machines

TLS profile

The TLS implementation intentionally recognizes one small profile:

• TLS 1.3 external PSK in psk_ke mode
• exactly TLS_CHACHA20_POLY1305_SHA256
• one configured identity with a 32-byte, high-entropy PSK
• no certificates, Diffie-Hellman, 0-RTT, tickets, key updates, alerts, record padding, legacy TLS, or cipher negotiation

tls_client.lux and tls_server.lux are front ends over tls13_psk.lux. They get handshake randomness from random.lux; TCP remains a separate transport, so callers pass complete TLS records between the state machine and their TCP connection. The deterministic main() performs a full handshake, bidirectional application-data exchange, and tamper-rejection check.

This is a compact system-building profile, not a general web TLS stack and not a substitute for an audited production cryptographic library. psk_ke does not provide forward secrecy. Provision PSKs as uniformly random 32-byte values, keep them out of source control, and use a unique identity/PSK per trust pair.

Disk storage

disk_storage.lux stores one key/value record per 512-byte sector. Each sector contains a magic value, format version, bounded lengths, an FNV-1a corruption checksum, and zero padding. The format supports keys up to 64 bytes and values up to 431 bytes. It detects accidental corruption; it does not authenticate or encrypt data.

Entry points

• secure_random_bytes(length) — 1..4096 bytes from the kernel entropy device
• storage_open(), storage_put(), storage_get() — disk record operations
• secure_tls_client_start() / tls_client_accept() — client handshake
• secure_tls_server_accept() / tls_server_finish() — server handshake
• tls_send() / tls_receive() — authenticated application records