clazel-crypto: verified CertificateVerify signatures (ECDSA P-256, RSA-PSS, Ed25519); stop offering rsa_pss_pss

crates/clazel-crypto/Cargo.toml

@@ -4,10 +4,13 @@ version = "0.0.0"
 edition.workspace = true
 license.workspace = true
 publish.workspace = true
-description = "The libcrux providers for clazel-tls's cryptographic parameters: SHA-256, HMAC, HKDF, ChaCha20-Poly1305 and X25519."
+description = "The libcrux providers for clazel-tls's cryptographic parameters: SHA-256, HMAC, HKDF, ChaCha20-Poly1305, X25519 and CertificateVerify signatures."
 
 [dependencies]
 clazel-tls = { path = "../clazel-tls" }
+# The end-entity key is parsed with our own decoders (CLAUDE.md rule 8).
+clazel-der = { path = "../clazel-der" }
+clazel-x509 = { path = "../clazel-x509" }
 vstd = "=0.0.0-2026-10-04-0306"
 # Shipped cryptography (docs/DEPENDENCIES.md, class `shipped`; phase-3.md
 # items 3.0 and 3.5f). Pinned exactly: libcrux is pre-release (0.0.x), so
@@ -18,6 +21,9 @@ libcrux-hmac = { version = "=0.0.9", default-features = false }
 libcrux-hkdf = { version = "=0.0.9", default-features = false }
 libcrux-chacha20poly1305 = { version = "=0.0.10", default-features = false }
 libcrux-curve25519 = { version = "=0.0.9", default-features = false }
+libcrux-ecdsa = { version = "=0.0.9", default-features = false }
+libcrux-rsa = { version = "=0.0.9", default-features = false }
+libcrux-ed25519 = { version = "=0.0.10", default-features = false }
 
 # Verification tier (docs/VERIFICATION.md). The crate parses nothing; its
 # adapters are checked by Verus against clazel-tls's provider contracts, and

crates/clazel-crypto/README.md

@@ -19,6 +19,8 @@ independent). Its own code is the adapters, which Verus checks against
 | `Crypto::expand` | HKDF-Expand, RFC 5869 §2.3 | `libcrux_hkdf::sha2_256::expand` |
 | `traffic::provider::Factory` and `record::Aead` | ChaCha20-Poly1305, RFC 8439 §2.8 | `libcrux_chacha20poly1305::{encrypt, decrypt}` |
 | `hello::key_exchange::KeyExchange` | X25519, RFC 7748 | `libcrux_curve25519::{secret_to_public, ecdh}` |
+| `auth::spec::Verification::signature` (CertificateVerify), as `signature::exec::verify` | ecdsa_secp256r1_sha256, rsa_pss_rsae_sha256/384/512, ed25519 (RFC 8446 §4.2.3) | `libcrux_ecdsa::p256::verify`, `libcrux_rsa::verify`, `libcrux_ed25519::verify` |
+| Finished comparison (`Verifier::finished_equal`), as `compare::constant_time_eq` | RFC 8446 §4.4.4 | none: ours, proven, no data-dependent branch |
 
 ## The trust boundary
 
@@ -46,10 +48,25 @@ Modelling choices:
   `unsafe`. The HMAC-SHA256 path calls only `libcrux-sha2`. The choice was
   made on 2026-10-26; see docs/DEPENDENCIES.md.
 
+## Signature verification
+
+`signature::exec::verify(key, scheme, input, signature)` is proven equal to
+`signature::spec::verify`. The end-entity key is its DER SubjectPublicKeyInfo,
+parsed by `clazel-x509`, and an ECDSA signature's Ecdsa-Sig-Value is parsed by
+`clazel-der`. Only the three verifications are libcrux's. What it accepts, and
+everything it refuses, is listed at the top of `src/signature/spec.rs`: the
+secp256r1 uncompressed point only, RSA keys with e = 65537 and a modulus of
+exactly 2048/3072/4096/6144/8192 bits, and Ed25519 keys without parameters.
+The `rsa_pss_pss_*` schemes are neither offered nor verified.
+
+Tests use RFC 8032 §7.1 (Ed25519) and RFC 6979 A.2.5 (ECDSA P-256)
+vectors, and our own RSA-PSS fixtures in `tests/fixtures/rsa-pss` (see the
+`SOURCE.md` there).
+
 ## Not here
-- Signature verification: ECDSA P-256, RSA-PSS and Ed25519 from libcrux, and
-  RSA PKCS#1 v1.5 from `clazel-pkcs1`. These come with certificate path
-  validation (3.5b).
+- The `auth::verify::Verifier` implementation itself. Its `chain` half is
+  certificate path validation (3.5b). Certificate signatures (RSA PKCS#1
+  v1.5 from `clazel-pkcs1`, and ECDSA with SHA-384) come with it.
 - Randomness: the caller supplies the X25519 private scalar.
 - Any side-channel claim beyond HACL\*'s. libcrux's README makes none for the
   extracted Rust, and this crate adds no secret-dependent branches.