§11.7/§11.3: P-256 cipher suite (KT_128_SHA256_P256, 0x0001)

[OR13]

The only out of scope row in the coverage table, and the largest remaining chunk of coverage that a peer can actually verify. katie implements the suite fully (crypto/suites/kt_sha256_p256.go, crypto/vrf/p256).

Missing here: ECVRF-P256-SHA256-TAI (§11.7) and ECDSA-P256 signature verification (§11.3, §11.4). hash.rs, commitment.rs and suite.rs already handle both suites.

What it buys, precisely. Both suites use SHA-256 and identical commitment fixed bytes, so commitment.json, log-tree.json, prefix-tree.json, log-append.json, prefix-mutation.json and the pure-math families are byte-identical under P-256 and gain nothing. The new surface is:

• a new VRF primitive with two independent oracles — katie and RFC 9381's test vectors;
• ECDSA-P256 tree-head and auditor-head signatures (verification is deterministic, so katie-produced signatures pin fine);
• 0x0001 in every Configuration encoding, pinning §11.1/§17.1 in both suites;
• VRF.Np = 81, which changes every BinaryLadderStep's length. The response decoders take proof_size as context and have only ever run at 80.

Cost: a p256 dependency, and a parallel VRF module — vrf.rs is curve25519-dalek-specific throughout and implements proving as well as verifying.

[OR13]

Implemented in #34, both halves agreeing with katie on the first run. vrf.rs split into vrf/{mod,edwards25519,p256}.rs; ECVRF verified against RFC 9381 Appendix B.1 and vrf-p256.json; ECDSA against tree-head-p256.json.

Verification only for the VRF, deliberately: RFC 9381 §5.4.2.1 derives P-256's nonce with RFC 6979, which is a log's concern. The report row says so rather than implying a prover exists.

What remains: threading VRF.Np = 81 end-to-end through a live SearchResponse. The decoders take proof_size as context and now have a suite that isn't 80, but search_suite in check.rs hardcodes Kt128Sha256Ed25519 and ladder_keys builds Ed25519 VRF keys, so a P-256 search.json needs those parameterised. buildLog in the Go generator already takes a suite, so that side is nearly free.

Leaving this open for that.