[atiernan]

PR5 of P-384 ECDSA verification (3.5h). It adds the conformance suites and a differential against an independent engine for clazel-p384::verify. src/ is unchanged apart from a doc comment in lib.rs, axioms.rs is still the reviewed file (e9ee88f1…a4e3), and the crate stays at tier 0.

Commits

• 32ad88c: vendors the test vectors byte for byte. Each directory has a SOURCE.md (URL, commit or zip SHA-256, size, file SHA-256) and its licence. Also adds an xtask converter for each suite.
  • Wycheproof ecdsa_secp384r1_sha{256,384,512}_test.json at d17cc89f, the commit clazel-pkcs1 already pins. Apache-2.0. The P1363 files are not vendored.
  • NIST CAVP FIPS 186-4 SigVer.rsp, from 186-4ecdsatestvectors.zip (zip SHA-256 fe47cc92…4752). Public domain. The converter keeps the five P-384 sections.
  • xtask/src/testdata.rs now lets SOURCE.md give the zip's SHA-256: in place of a Commit:, with a unit test, since NIST has no commit to pin.
• d570ce2: tests/conformance_ecdsa.rs and tests/differential_ring.rs, the dev-dependencies, and [profile.dev.package.clazel-p384] opt-level = 3 in the workspace manifest (design Q5). Overflow checks stay on.

Results

clazel-conformance: suite="Wycheproof ecdsa_secp384r1_sha256" pass=472 xfail=0 fail=0 total=472
clazel-conformance: suite="Wycheproof ecdsa_secp384r1_sha384" pass=504 xfail=0 fail=0 total=504
clazel-conformance: suite="Wycheproof ecdsa_secp384r1_sha512" pass=542 xfail=0 fail=0 total=542
clazel-conformance: suite="CAVP 186-4 SigVer P-384" pass=75 xfail=0 fail=0 total=75
clazel-conformance: suite="Differential vs ring 0.17.14 P-384 SHA-384" pass=14000 xfail=0 fail=0 total=14000

Every case agrees with verify. There are no expected failures, and no Wycheproof case at this commit is acceptable.

• DER signatures: clazel-p384 has no DER layer of its own. The test reads each Wycheproof Ecdsa-Sig-Value with our clazel-der (non-negative, at most 48 magnitude octets, nothing trailing). It refuses 705 malformed encodings, none of them a valid case, and they still count in total.
• CAVP digests: these include SHA-1 and SHA-224, which exercise short digests.
• The ring differential: 2,000 signatures, each tried 7 ways (valid; a bit flipped in r, s, the message or the key; another key; edge values of r and s). Both engines accept 2,000 and refuse 12,000. Signatures differ between runs, because ring's random source can't be seeded; a failure prints the case in hex.

Dependencies

• New package: sha1 0.10.6, class tooling, used by xtask's converter. xtask also now uses sha2, which was already listed.
• clazel-p384 dev-dependencies: clazel-der, sha2 =0.10.9 and ring =0.17.14. ring was already in Cargo.lock. The "why" text of its rows and its dependencies' rows is updated, with classes unchanged.

Checks done

• cargo xtask check passes, including the allowlist, pins and generated test data.
• clippy and fmt are clean, and cargo test -p xtask passes.
• I re-ran conformance_ecdsa independently of the agent: all four lines above, in 29 s.
• The differential takes about 80 s on 8+ cores. It may take a few minutes on CI runners. SIGNATURES at the top of the file sets its size.
• Miri ignores the three slow tests.

The workspace-manifest change makes CI select every crate on this PR.

Not done

• ACVP-Server JSON vectors.
• A SHA-256 differential (ring can't sign P-384 with SHA-256; Wycheproof covers it).
• An independent transcription, mutations of the exec code and Kani, which are the remaining tier-2 items.

CI has not run yet.

🤖 Generated with Claude Code