v0.4.22 — Rust engine: full ECDSA/ECDH P-521 + EdDSA safety

What's New

Added — Rust engine: full ECDSA/ECDH P-521

The pure-Rust WASM engine now supports NIST P-521 across all EC operations, completing the P-256 / P-384 / P-521 / secp256k1 curve matrix in the Rust backend:

• Keygen — C_GenerateKeyPair dispatches to P-521 via OID detection (CKA_EC_PARAMS last byte 0x23 = secp521r1)
• Sign / Verify — CKM_ECDSA_SHA512: native SHA-512 for P-521 (no FIPS 186-5 hash truncation required at this security level); CKM_ECDSA prehash mode also supported
• ECDH — CKM_ECDH1_DERIVE via p521::ecdh::diffie_hellman
• Encoding — new build_ec_spki_p521() helper DER-encodes the 133-byte uncompressed P-521 public key in SubjectPublicKeyInfo format with the id-ecPublicKey + secp521r1 OID
• Cargo.toml — p521 = { version = "0.13", features = ["ecdsa", "ecdh"] } and lazy_static = "1.4.0" added

Fixed — Rust EdDSA safety

verify_eddsa() and verify_eddsa_ph() replaced .unwrap() with .try_into().map_err(|_| CKR_KEY_TYPE_INCONSISTENT). Malformed public key bytes now return a PKCS#11-compliant error code instead of triggering an unrecoverable WASM panic.

Changed

• README / docs/rust-engine.md — algorithm parity tables and Rust crate list updated to reflect full P-256/P-384/P-521/secp256k1 coverage across both engines
• Security audit (docs/security_audit_04132026.md) — CWE-305 and CWE-208 documented as accepted risks (educational/ACVP design intent); CWE-400 (ffi.rs .unwrap() panics) and CWE-120 (strncpy bounds, C++) flagged for future hardening

Rust Engine — EC Curve Matrix (as of v0.4.22)

Curve	Keygen	ECDSA sign/verify	ECDH	Engine
P-256	✅	✅ CKM_ECDSA + SHA256/SHA3	✅	Rust + C++
P-384	✅	✅ CKM_ECDSA + SHA384/SHA3	✅	Rust + C++
P-521	✅	✅ CKM_ECDSA_SHA512 (native)	✅	Rust + C++ (new)
secp256k1	✅	✅ CKM_ECDSA_SHA256	—	Rust + C++
X25519	✅	—	✅ CKM_ECDH1_DERIVE	Rust + C++
X448	✅	—	✅ CKM_ECDH1_DERIVE	Rust + C++