Pure refactors for the Charon/Aeneas extraction pipeline; production
behavior unchanged (both default and pinned configs cargo-check clean,
pre-existing warnings only).
- ed_sigs::sha512_hash3: single-call SHA-512 oracle, semantically
Sha512(r || a || m); a monomorphic signature with no foreign types lets
the extractor treat the hash as one opaque oracle (sha2-0.11 stack).
- VerificationKey::verify_sha512 (+ recompute_r_sha512, a_bytes_nonzero,
check_scalar_canonical, is_legacy_excluded_r): semantically identical
to verify_dalek with each step spelled extractor-friendly - derived
array PartialEq/contains as explicit index loops, and
Scalar::from_canonical_bytes (subtle internals defeat the extractor)
as an explicit s < l byte compare + from_bytes_mod_order (the identity
on canonical bytes). Signature accessors each called exactly once.
- SIMD gates: cfg(target_arch = "x86_64") becomes
cfg(all(target_arch = "x86_64", not(curve25519_serial_only))). Default
builds are identical (the new cfg is never set); extraction builds pass
RUSTFLAGS=--cfg curve25519_serial_only so the AVX2 dispatch arm
compiles out and backend selection is the real constant Serial - the
same serial-pin mechanism upstream curve25519-dalek provides natively.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Add prechecked optimized triple-base mul
Introduce a prechecked 128/128/256 optimized path for vartime triple-base multiplication: vartime_triple_base_mul_128_128_256 now checks whether a1 and a2 fit in 128 bits and falls back to general multiplication if not. Add vartime_triple_base_mul_128_128_256_prechecked and corresponding serial/vector backend implementations (renamed to *_prechecked). Add scalar_fits_in_128_bits helper and update callers (verification_key) to use the prechecked path. Update docs/comments and add a test to ensure full-width scalars are handled by the fallback path.
* bring back the docs
* CI
Add strict SPKI validation and tests for PKCS#8 public keys. Introduce OID and ALGORITHM_ID constants and refactor SPKI parsing into verification_key_bytes_from_spki which verifies the algorithm OID, parameters, and key byte length/format, returning appropriate pkcs8::spki::Error values. Update TryFrom/EncodePublicKey/DecodePublicKey implementations to use the new helper and to propagate/mapping errors correctly. Add two tests (behind the pkcs8 feature) to assert rejection of SPKI docs with the wrong algorithm OID and with malformed key bytes.
* Initial commit
* skeleton
* refactor and merge curve and ed crates
* fmt
* ci
* fmt again
* ci
* Update bench.rs
* fix ubuntu
* implement dalek api
* clean up
