mrwulf 3153988c4e tests: NIST ACVP SHA2-128s verification KATs + a real differential bridge ... External review flagged across rounds 4-6 that the empirical evidence tying the proved model to the deployed code had not moved by a single data point in six rounds: the sole bridge was nine assertion points (3 rounds, one fixed seed, corruption always at byte 100), and the ACVP vectors vendored here contain NO SLH-DSA-SHA2-128s sigVer group at all — the one parameter set this verification campaign is about had zero NIST known-answer verification coverage. VECTORS. tests/nist_acvp_vectors/SLH-DSA-sigVer-FIPS205/sha2_128s_extracted.json carries the three SHA2-128s sigVer groups extracted verbatim from the official NIST ACVP-Server vector set (source URL, upstream file sha256 and extraction method recorded in the file's own _provenance block; per-test private keys dropped as unnecessary to verify). 42 tests: 2 valid and 12 negative per group, the negatives spread over structurally distinct corruption sites — modified R, modified SIGFORS, modified SIGHT, modified message, too-small and too-large signatures. TESTS (all in src/verify_mono.rs, so they exercise the monomorphic path the Lean certificates are about): - mono_matches_nist_acvp_128s_internal — NIST's `internal` group carries M' directly, which is exactly what slh_verify_128s consumes, so these are true known-answer tests OF THE PROVED PATH: 10 executed, 4 attributed to deserialization (wrong-length signatures, rejected above the extraction root). Accounting is exact — all 14 are accounted for, nothing silently skipped. - mono_matches_nist_acvp_128s_external_pure — builds M' the way lib.rs does and requires mono, the deployed verifier and NIST to agree: 10 executed, 9 of them with a NON-EMPTY context. This is the first empirical check of the domain-separator byte and context-length prefix that TRUSTED-BASE item 10 declares outside every proof. - deployed_matches_nist_acvp_128s_prehash — validates the deployed prehash path for 128s: 3 executed, 4 wrong-length, and 7 skipped because NIST exercises prehash functions (SHA3-*, truncated SHA2) this crate's `Ph` enum does not implement. Counted and reported rather than hidden. - mono_matches_deployed_randomized — replaces the fixed-seed/fixed-byte bridge: 12 rounds, varying message lengths including empty, corruption spread across the WHOLE 7856-byte signature, plus wrong-public-key and wrong-context cases that were never exercised before. 108 assertion points, each requiring mono and deployed to agree. Bridge coverage: 9 assertion points -> 131, of which 20 are NIST known-answer tests on the proved path where there were previously none. No change to any verify-path function: this commit touches test code and test data only, so the Charon/Aeneas extraction is unaffected (verified separately by re-running extract.sh and diffing the generated model). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-28 09:42:56 +02:00
..
nist_acvp_vectors	tests: NIST ACVP SHA2-128s verification KATs + a real differential bridge	2026-07-28 09:42:56 +02:00
integration.rs	prep update	2024-10-01 09:30:20 -05:00
messages.rs	dudect, workflows	2024-10-03 12:24:28 -05:00
py_vectors.rs	much tighter clippy	2024-10-02 16:02:02 -05:00