sshserver: russh's p384 on its own bignum backend, host and guest, so no fiat-crypto compiles in

.cargo/config.toml

@@ -1,11 +1,18 @@
 # One table per guest triple, since the workspace builds for all of them and for
-# the host: a guest build names its triple with `--target`, and a host build
-# takes no flags from here.
+# the host: a guest build names its triple with `--target`. A build for a triple
+# with no table here, the host's and the host apps' included, takes `[build]`'s.
 
 # A checkout's own configuration, untracked: a fork clone under edit is listed
 # there (`.claude/agents/implementer.md`, "A fork").
 include = [{ path = "local.toml", optional = true }]
 
+# `p384`'s field and scalar arithmetic in its own `bignum` backend, here and in
+# the ToyOS tables, whose flags replace these: its default is fiat-crypto, which
+# ToyOS takes as a dependency of no kind. Only russh reaches `p384` 0.14
+# (`system/sshserver`, on the host and the guest), and this goes with it.
+[build]
+rustflags = ["--cfg=p384_backend=\"bignum\""]
+
 [target.x86_64-unknown-none]
 rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes"]
 
@@ -38,10 +45,10 @@ rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek
 rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek_backend=\"serial\"", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"]
 
 [target.x86_64-unknown-toyos]
-rustflags = ["-Dwarnings"]
+rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""]
 
 [target.aarch64-unknown-toyos]
-rustflags = ["-Dwarnings"]
+rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""]
 
 # `tests/guest/osbench`'s Linux build, static so a bench runs it without a
 # toolchain, linked by the toolchain's own LLD so no C toolchain is needed, and

issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md

@@ -32,6 +32,18 @@ Compromises of `toyos-ssh` recorded on their own:
 `issues/toyos-ssh-offers-only-a-classical-key-exchange.md` and
 `issues/toyos-ssh-leaves-its-secrets-in-freed-memory.md`.
 
+A compromise of the server shipped today, until stage 2: russh's `p384`
+runs on its `bignum` backend (`--cfg=p384_backend="bignum"` in
+`.cargo/config.toml`), which keeps fiat-crypto out under the owner's ruling
+that ToyOS takes it as a dependency of no kind. `p384` 0.14.0-rc.8 calls that
+backend experimental and says it "might also have bugs", where fiat's is
+formally verified (`src/lib.rs`). sshserver reaches P-384 in two places:
+it verifies a client's `ecdsa-sha2-nistp384` publickey signature, which is
+untrusted input before authentication, and it signs with a P-384 host key
+when the operator's host-key file holds one (a minted key is Ed25519). It
+negotiates no `ecdh-sha2-nistp384`: russh's default order leaves it out.
+Owner: this track's. Exit: stage 2, which deletes russh and the setting.
+
 ## Stages
 
 1. **The core, on the host.** `toyos-ssh`: strict `curve25519-sha256`, the
@@ -59,6 +71,7 @@ Compromises of `toyos-ssh` recorded on their own:
      entry.
    - `Cargo.lock` has no `russh`, `russh-cryptovec`, `rsa`, `pageant` or
      `internal-russh-num-bigint` package.
+   - `.cargo/config.toml` sets no `p384_backend`.
    - A recorded `sftp` session and a recorded shell session replay byte for
      byte under `cargo run -- --ci host`.
 3. **ML-KEM.** Our own `mlkem768x25519-sha256`, on `toyos-crypto`'s