v2.0.0

Changed

• RSAPubkey::hash() now returns [Field; 2] — separate Poseidon hashes for modulus and redc parameter
• hashRSAPublicKey() JS function now returns { modulusHash, redcHash } instead of a single bigint
• Example circuit outputs grow from 2 to 3 public fields ([modulus_hash, redc_hash, email_nullifier])

Added

• poseidon_large_padded_1024 helper for hashing 1024-bit keys by zero-padding to 2048-bit width
• 1024-bit key support in JS hashRSAPublicKey() (accepts 9-limb arrays)
• RSAPublicKeyHashes type export from JS package
• Regression tests for redc binding on both 1024-bit and 2048-bit code paths

Fixed

• Bind prover to redc parameter — previously only the modulus was hashed, allowing a malicious prover to supply an arbitrary redc and still match the public key hash (Veridise vulnerability reintroduced in PR #52)

Breaking Changes

• Verifier keys must be regenerated. The hash() return type and circuit outputs have changed.
• JS consumers must update to destructure { modulusHash, redcHash } instead of using a single bigint return value.