crypto: harden correctness and backend assurance

.cargo/config.toml

@@ -13,14 +13,6 @@ rustflags = ["-C", "target-feature=+lse", "-C", "target-cpu=native"]
 [target.aarch64-pc-windows-msvc]
 rustflags = ["-C", "target-feature=+lse"]
 
-# macOS Apple Silicon
-[target.aarch64-apple-darwin]
-rustflags = ["-C", "target-feature=+lse", "-C", "target-cpu=native"]
-
-# macOS Intel
-[target.x86_64-apple-darwin]
-rustflags = ["-C", "target-cpu=native"]
-
 # Tier B
 # Linux x86_64 MUSL
 [target.x86_64-unknown-linux-musl]

.changes/avoid-duplicate-ed25519-secret-9748.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Avoid duplicate Ed25519 secret expansion and repeated HKDF prefix-state copies without changing outputs.

.changes/bound-password-record-pbkdf2-4c8b.md

@@ -0,0 +1,8 @@
+---
+"rscrypto" = "patch"
+---
+
+Bound default password-record PBKDF2 verification work while keeping raw
+derivation and compatibility policies unbounded. Custom record policies can
+set an explicit ceiling with `verify_with_policy_bounded` or
+`verify_password_with_policy_bounded`.

.changes/bounded-password-records.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Argon2 and scrypt password verification now reject noncanonical or over-budget

.changes/clear-ecdsa-accelerated-reductio-e464.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Clear ECDSA accelerated reduction and inversion scratch after use.

.changes/clear-ml-kem-secret-c6e5.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Clear ML-KEM secret SHA-3 and SHAKE state after use.

.changes/clear-portable-aead-authenticati-fff5.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Clear portable AEAD authentication state after use.

.changes/clear-rsa-private-key-f3e1.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Clear RSA private-key validation buffers on every return path.

.changes/collapse-rapidhash-to-the-3c61.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Collapse RapidHash to portable `RapidHash64`, `RapidStreamHasher`,

.changes/correct-aes-gcm-siv-a96a.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Correct AES-GCM-SIV RFC input bounds.

.changes/correct-cshake-and-kmac-2abd.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Correct cSHAKE and KMAC byte padding at exact rate boundaries.

.changes/correct-x86-and-power-6479.md

@@ -0,0 +1,6 @@
+---
+"rscrypto" = "patch"
+---
+
+Correct x86 CRC-16 and CRC-24 four-way tails, x86 and POWER capability detection, and cached initialization after a
+panic.

.changes/make-cryptographic-boundaries-mi-fba1.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Make cryptographic boundaries misuse-resistant: keyed BLAKE2 uses validated borrowed key types and variable outputs fail with typed errors, normal AEAD sealing owns nonce issuance while caller nonces require an expert import, entropy and platform override failures no longer panic, and diagnostic or dangerous capabilities no longer clutter the crate root.

.changes/normalize-rsa-crt-exponents-5f58.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Normalize RSA CRT exponents before private operations.

.changes/owned-secret-equality.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Secret comparison is now owned by fixed-size cryptographic key, tag, and

.changes/preserve-a-scalar-declassificati-452a.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Preserve a scalar declassification boundary for fixed-size secret-owner equality so optimized x86 builds remain covered by constant-time binary proofs.

.changes/rebind-reusable-rsa-scratch-5003.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Rebind reusable RSA scratch state when switching between same-width keys.

.changes/reject-sha-384-sha-62b4.md

@@ -0,0 +1,6 @@
+---
+"rscrypto" = "patch"
+---
+
+Panic before absorbing SHA-384, SHA-512, or SHA-512/256 input that would
+exceed the FIPS 180-4 length field instead of wrapping the encoded bit length.

.changes/reject-weak-rsa-private-factors-a8c2.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "major"
+---
+
+Reject RSA private-key imports with nonstandard-width factors or factors that fail probable-prime screening.

.changes/require-security-strength-kmac-8015.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Require security-strength KMAC tags in default verification APIs and provide explicit primitive verification for protocol-defined shorter tags.

.changes/seal-secret-bearing-comparison-4815.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Secret-bearing fixed-size keys, shared secrets, keypairs, authentication tags,

.changes/secret-bearing-hmac-hkdf-8528.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 Secret-bearing HMAC, HKDF, KMAC, and PBKDF2 states no longer implement

.changes/typed-jwt-verifier.md

@@ -1,5 +1,5 @@
 ---
-"rscrypto" = "minor"
+"rscrypto" = "major"
 ---
 
 RSA JWT/JWS verification is now bound to one verifier-owned

.changes/verify-imported-assembly-and-7c0b.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Verify imported assembly and cryptographic test vectors against immutable upstream sources and deterministic transforms.

.github/workflows/_ci-suite.yaml

@@ -84,7 +84,7 @@ jobs:
     uses: ./.github/workflows/_rust-job.yaml
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
-      timeout_minutes: 90
+      timeout_minutes: 120
       cache_key: ${{ inputs.cache_key_prefix }}-feature-contracts
       tools_mode: minimal
       toolchain_components: "rust-src"
@@ -140,6 +140,19 @@ jobs:
       operation: native-ibm
       test_mode: ${{ inputs.test_mode }}
 
+  platform-amx:
+    name: Platform (Linux x64 AMX permission)
+    uses: ./.github/workflows/_rust-job.yaml
+    with:
+      runner: runs-on=${{ github.run_id }}/runner=intel-spr
+      timeout_minutes: 30
+      cache_key: ${{ inputs.cache_key_prefix }}-platform-amx
+      tools_mode: none
+      toolchain_components: "rustfmt"
+      enable_magic_cache: true
+      enable_rust_cache: true
+      operation: platform-amx
+
   cross-targets:
     name: Cross Targets
     uses: ./.github/workflows/_rust-job.yaml

.github/workflows/ci.yaml

@@ -47,18 +47,28 @@ jobs:
           enable-magic-cache: false
           enable-rust-cache: true
 
+      - name: Build Plan (PR)
+        if: github.event_name == 'pull_request'
+        id: rail
+        uses: loadingalias/cargo-rail-action@f622a3936a231fe78a772292c6892d71e8c57f9f  # v6.1.0
+        with:
+          version: "0.20.0"
+          checksum: required
+          since: ${{ github.event.pull_request.base.sha }}
+
       - name: Resolve Build Plan
         if: always()
         id: resolve
         env:
-          RAIL_PLAN_STEP_OUTCOME: ${{ steps.rail_setup.outcome }}
-          RAIL_SINCE: origin/${{ github.base_ref }}
+          RAIL_PLAN_STEP_OUTCOME: ${{ steps.rail.outcome }}
+          RAIL_SCOPE_JSON: ${{ steps.rail.outputs.scope-json }}
+          RAIL_SURFACES_JSON: ${{ steps.rail.outputs.surfaces-json }}
         run: scripts/ci/resolve-rail-plan.sh
 
       - name: Check Release Intent Coverage
         if: github.event_name == 'pull_request'
         env:
-          RAIL_BASE_REF: origin/${{ github.base_ref }}
+          RAIL_BASE_REF: ${{ steps.rail.outputs.base-ref }}
         run: cargo rail change check --since "$RAIL_BASE_REF" --required
 
   dependency-smoke:

.github/workflows/rsa.yaml

@@ -58,9 +58,25 @@ jobs:
       artifact_path: ci-evidence/rsa-leakage-${{ matrix.target.name }}.log
       artifact_always: true
 
+  rsa-linux-x86_64-asm:
+    name: RSA Assembly (Linux x86-64)
+    uses: ./.github/workflows/_rust-job.yaml
+    with:
+      runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
+      timeout_minutes: 45
+      cache_key: rsa-linux-x86_64-asm
+      tools_mode: none
+      toolchain_components: ""
+      enable_magic_cache: true
+      enable_rust_cache: true
+      operation: rsa-linux-x64-asm
+      artifact_name: rsa-linux-x86_64-asm
+      artifact_path: ci-evidence/rsa-linux-x86_64-asm.log
+      artifact_always: true
+
   complete:
     name: Complete (RSA)
-    needs: [rsa-miri, rsa-leakage]
+    needs: [rsa-miri, rsa-leakage, rsa-linux-x86_64-asm]
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -69,7 +85,8 @@ jobs:
           failed=0
           for lane in \
             "rsa-miri=${{ needs.rsa-miri.result }}" \
-            "rsa-leakage=${{ needs.rsa-leakage.result }}"
+            "rsa-leakage=${{ needs.rsa-leakage.result }}" \
+            "rsa-linux-x86_64-asm=${{ needs.rsa-linux-x86_64-asm.result }}"
           do
             name="${lane%%=*}"
             result="${lane#*=}"

.github/workflows/weekly.yaml

@@ -91,7 +91,7 @@ jobs:
         fuzz-output/corpus.tar.gz
         fuzz/artifacts/
         fuzz-packages/*/artifacts/
-      artifact_always: false
+      artifact_always: true
 
   asan-fuzzing:
     name: ASan Fuzz Corpus (${{ matrix.target.name }})

CONTRIBUTING.md

@@ -3,7 +3,7 @@
 Use a short-lived feature branch for every change. `main` is the protected,
 releasable history; it is not a working branch.
 
-## What the gates do
+## Gate model
 
 | Action | Purpose |
 |---|---|
@@ -17,20 +17,25 @@ actors, so merged commits do not repeat the pull-request suite. Release
 candidates get a separate exact-commit Weekly run with the complete CI suite,
 Cargo graph assurance, and release evidence.
 
-## Daily branch workflow
+## Create a branch
 
-Start from current `main`:
+Start from a clean worktree and current `main`:
 
 ```bash
+git status --short
 git switch main
 git pull --ff-only
 git switch -c <short-feature-name>
 ```
 
-Make one focused change. Add a `.changes/*.md` file when crate users will
-observe the result: an API, behavior, security, performance, compatibility, or
-release-artifact change. Internal-only tooling and maintainer-documentation
-changes normally do not need one.
+Do not discard unrelated local changes to run this sequence. Preserve them or
+move them to their own branch first.
+
+## Record release intent
+
+Add a `.changes/*.md` file when crate users will observe an API, behavior,
+security, performance, compatibility, or release-artifact change. Internal
+tooling and maintainer-only documentation normally do not need one.
 
 ```bash
 just release-change patch "Describe the user-visible result."
@@ -40,6 +45,8 @@ Use `minor` or `major` instead of `patch` when the compatibility impact
 requires it. The pre-push check is the final authority on whether release
 intent is missing.
 
+## Validate the change
+
 Run checks proportional to the change. Common starting points are:
 
 ```bash
@@ -62,9 +69,12 @@ Use deeper checks where the risk requires them:
 | `unsafe`, SIMD, ASM, or dispatch | Backend equivalence tests and `just test-fuzz-asan --all` where the target runs natively |
 | Portable unsafe path | `just test-miri` |
 | Constant-time claim boundary | `just ct-full --target <triple>`; update `ct.toml` only with matching evidence |
+| Apple Silicon RSA assembly | `just test-rsa-macos-asm` on a physical local Arm64 Mac; GitHub Actions intentionally has no macOS runner |
 | Public API change | `cargo semver-checks --package rscrypto --all-features` |
 | Dependency or release change | `cargo deny check all` and `cargo audit --ignore RUSTSEC-2023-0071` |
 
+## Review and commit
+
 Inspect and commit only the intended files:
 
 ```bash
@@ -75,6 +85,8 @@ git diff --cached
 git commit -m "module: imperative outcome"
 ```
 
+## Push and open a pull request
+
 Push the current branch with its upstream. No extra Git flags are needed:
 
 ```bash
@@ -85,18 +97,20 @@ just push
 current branch. No rscrypto Git-hook installation is required. Use `just
 push-full` when the change is unusually broad or release-sensitive.
 
-Open a draft pull request while work is still changing; expensive jobs wait
-until the pull request is ready for review. A branch push alone does not start
-the normal PR suite:
+Open a draft pull request while the change is still in progress. Expensive jobs
+wait until the pull request is ready for review; a branch push alone does not
+start the normal pull-request suite:
 
 ```bash
 gh pr create --base main --fill --draft
 ```
 
 Mark the pull request ready only when its head is ready for CI, then wait for
-the required `Complete` check. Because the repository currently has one
-maintainer, no second approval is required; review the final diff yourself,
-resolve any open threads, and merge in the GitHub UI.
+the required `Complete` check. Resolve every open review thread and review the
+final diff before merging in the GitHub UI. GitHub enforces the current
+approval policy.
+
+## Clean up after merge
 
 After GitHub reports the pull request merged: