update: the image signature on toyos-crypto's Ed25519; ed25519-dalek is an oracle

.cargo/config.toml

@@ -30,19 +30,15 @@ rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes"]
 [target.aarch64-unknown-none-softfloat]
 rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "-Adead_code", "-Aunfulfilled_lint_expectations", "-Clink-arg=-pie", "-Clink-arg=-znotext"]
 
-# The loader's two tables are one list:
-# - `ed25519-dalek`'s field arithmetic in plain 64-bit integers: its default on
-#   x86-64 is the AVX2 backend, which this soft-float target has no registers
-#   for.
-# - `/Brepro` stamps the image with a hash of itself rather than the clock, and
-#   `/DEBUG:NONE` writes no PDB, whose GUID the image would otherwise carry and
-#   whose contents name the target directory: without both, two builds of one
-#   tree are two images.
+# The loader's two tables are one: `/Brepro` stamps the image with a hash of
+# itself rather than the clock, and `/DEBUG:NONE` writes no PDB, whose GUID the
+# image would otherwise carry and whose contents name the target directory:
+# without both, two builds of one tree are two images.
 [target.x86_64-unknown-uefi]
-rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek_backend=\"serial\"", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"]
+rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"]
 
 [target.aarch64-unknown-uefi]
-rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek_backend=\"serial\"", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"]
+rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"]
 
 [target.x86_64-unknown-toyos]
 rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""]

NOTICE

@@ -474,6 +474,22 @@ image carries them. These are every file of that directory for an interface the
 crate offers.
 
 
+lib/crypto/tests/data/ed25519_speccheck_cases.json — "Taming the many EdDSAs" cases, Apache-2.0
+-----------------------------------------------------------------------------------------------
+
+    ed25519_speccheck_cases.json  sha256 08e47a36d9aead288664930505584f353fff113ab854f2800db1e4f5b3540450
+    Upstream: https://github.com/novifinancial/ed25519-speccheck, `cases.json`
+    at commit 65519336fda78a3d016e947df6d82848aca0c9da, byte for byte
+    Licence text: lib/crypto/tests/data/speccheck-LICENSE (upstream's `LICENSE`,
+    sha256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4)
+    SPDX-License-Identifier: Apache-2.0
+
+The twelve edge cases of Chalkias, Garillot, Kondi and Nikolaenko, "Taming the
+many EdDSAs" (2020): small-order and non-canonical keys and points, and S
+past the group order. `toyos-crypto`'s host tests read them
+(`lib/crypto/tests/differential.rs`); no image carries them.
+
+
 tests/acvp/nist-*.json — NIST ACVP HMAC and ML-KEM vectors, NIST-Software
 -------------------------------------------------------------------------
 

build/licence.rs

@@ -900,6 +900,12 @@ pub const COMMITTED_FILES: &[(&str, &str, &str, Terms)] = &[
         "NOTICE",
         Terms::Spdx("Apache-2.0"),
     ),
+    (
+        "lib/crypto/tests/data/ed25519_speccheck_cases.json",
+        "08e47a36d9aead288664930505584f353fff113ab854f2800db1e4f5b3540450",
+        "NOTICE",
+        Terms::Spdx("Apache-2.0"),
+    ),
     (
         "tests/acvp/nist-hmac-sha1.json",
         "6e96eb5f53065219c437a99fedec7299c916c76e170d6b74507dc5409ed9cd6b",

build/ssh/Cargo.toml

@@ -16,5 +16,5 @@ publish = false
 toyos-crypto = { path = "../../lib/crypto", features = ["sign"] }
 # The one `SHA256:` fingerprint a key is named by, the one the package
 # repository's keys are named by too; and the public key of a seed, which the
-# image-signing key read through `hostkey` is derived with.
-toyos-update = { path = "../../lib/update" }
+# image-signing key read through `hostkey` is derived with, which is `sign`'s.
+toyos-update = { path = "../../lib/update", features = ["sign"] }

issues/toyos-crypto-is-in-the-tree-on-par-with-ring-and-secure.md

@@ -60,9 +60,9 @@ review has been done, and passing vectors does not show it is safer than ring.
 | Consumer | Today | Needs from the crate |
 |---|---|---|
 | `toyos-ssh`'s SSH protocol (`build/ssh`: `kex`, the server, the client). Host-only until `issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md` stage 2 | the crate, since stage 1 | X25519, ML-KEM-768 and its hybrid, Ed25519 sign/verify, `chacha20-poly1305@openssh.com`, SHA-256/512, and a caller-supplied `Random` for replays |
-| `toyos-ssh`'s `hostkey` on the signing path. `build/signing.rs` reads the owner's image-signing key through `openssh_seed` and writes a minted one through `openssh_private`; both derive the public key from the seed | `toyos_update::sig::public_of`, since stage 1 | nothing: this derivation is the root of trust's; the verifier itself switches in stage 6 |
+| `toyos-ssh`'s `hostkey` on the signing path. `build/signing.rs` reads the owner's image-signing key through `openssh_seed` and writes a minted one through `openssh_private`; both derive the public key from the seed | `toyos_update::sig::public_of`, the crate's since #1019 | nothing |
 | `system/sshserver` | russh with the RustCrypto stack, including `rsa` (RUSTSEC-2023-0071) | none directly; it reaches the crate through `toyos-ssh` |
-| Image and package signing: `lib/update` (the loader, `/system/bin/update`, `build/signing.rs`, `build/root`, #892's repository keys) | `ed25519-dalek` `verify_strict`, which hashes with the loader's `sha2` under `force-soft`; the crate's SHA-512 over the signed header, since #1016 | strict Ed25519 verification in the soft-float UEFI loader, and signing behind `sign` on the host. The track's last stage, stage 6 (owner, 2026-10-13) |
+| Image and package signing: `lib/update` (the loader, `/system/bin/update`, `build/signing.rs`, `build/root`, #892's repository keys) | the crate's strict Ed25519 and SHA-2, since #1019; signing and a seed's public key behind `sign`, on the host | stage 6's bench readings |
 | Every SHA-256: the build, `pkg`, `lib/swap`, `system/update`, `lib/update` and the loader | the crate, since #1016: SHA-NI on x86-64, the UEFI loader's in a block that saves the XMM registers it uses; the Armv8 SHA instructions where the target promises them. No slower than `toyos-sha2-hw`, which it replaces, on either bench: on the T14 4.6 times as fast at 64 B and 9 and 6 percent faster at 16 KiB and 1 MiB, on the AMD bench 2.8 times at 64 B, 2 percent at 16 KiB and equal at 1 MiB (#1016's evidence) | nothing |
 | ToyOS's own HTTPS clients. On the host: the build's `ureq` (`build/release.rs`) and doom's build script (`apps/doom/build.rs`). In a guest, none today: `https_tls13` and `pkg install <url>` are stages 3 and 5 of `issues/the-internet-clients-work-unchanged.md` | rustls on `ring`, which is `ToyOSOrg/ring` in a guest | the rustls provider through ureq's `rustls-no-provider` feature. Stage 5, once parity and security hold (owner, 2026-10-13) |
 | Wi-Fi's `wlan` (`issues/there-is-no-wifi.md` P6, W2) | nothing yet | PBKDF2-HMAC-SHA1, the 802.11i PRF and RFC 3394 unwrap, which the crate has. AES-CMAC-128, SAE over P-256 by hash-to-element, a public constant-time comparison and a public wiping secret, which it lacks |
@@ -325,7 +325,7 @@ Not consumers:
        `cfg(curve25519_dalek_backend = "fiat")`, which nothing in the tree
        sets, so no build compiles it. It is reached through `toyos-crypto`'s
        own oracles `x25519-dalek` 2.0.1 and `ed25519-dalek` 2.2.0, and
-       through `lib/update`'s `ed25519-dalek`.
+       `lib/update`'s `ed25519-dalek` oracle: test-only since #1019.
      - Under russh (`system/sshserver`), `curve25519-dalek` 5.0.0-pre.6
        names `fiat-crypto` 0.3.0 behind the same unset `cfg`.
      - Under russh, `p384` 0.14.0-rc.8 names `fiat-crypto` 0.3.0 unless
@@ -489,20 +489,40 @@ Not consumers:
    - Wi-Fi's P6 is this crate's AES-CMAC, SAE by hash-to-element, public
      constant-time comparison and public wiping secret, each against its RFC
      or Annex J vectors.
-6. **The root of trust, last.** The loader and `lib/update` verify, and the
-   host signs, with the crate. The owner ruled on 2026-10-13 that this is the
-   track's last stage, taken only after every stage 4 exit holds.
+6. **The root of trust.** The loader and `lib/update` verify, and the host
+   signs, with the crate. The owner ruled on 2026-10-13 that this is the
+   track's last stage, taken only after every stage 4 exit holds, and on
+   2026-10-22 that the tree uses the crate now and improves it in place
+   ("use our own crypto where possible"); #1019 takes it.
    **Exit**:
    - Ring stays a host differential oracle of the verifier.
    - The edge corpus is Wycheproof's `ed25519` and the vectors of Chalkias
      et al., "Taming the many EdDSAs" (2020). On both corpora the crate agrees
      with `ed25519-dalek`'s `verify_strict` and with ring.
+     - **Awaiting the owner, as this exit cannot hold as written:** on the
+       twelve cases every verdict of the crate's is `verify_strict`'s, and
+       ring accepts four that `verify_strict` refuses: the small-order key of
+       cases 0 and 1, the small-order R of case 2 and case 11's
+       non-canonical R. No verifier agrees with both. #1019 pins ring's
+       verdicts (`lib/crypto/tests/differential.rs`,
+       `speccheck_cases_against_dalek_strict_and_ring`).
    - The loader verifies a signed image on the T14 and the AMD bench, with
-     its verification time measured on each.
-   - An AArch64 QEMU loader boot verifies a signed image, because the crate's
-     UEFI path has never run.
+     its verification time measured on each. Done (#1019's probe image,
+     #1016's evidence): 253,975 counter ticks on the T14 at its stated
+     2.4192 GHz, about 105 µs, and 122,724 on the AMD bench, whose CPU states
+     no counter rate.
+   - An AArch64 QEMU loader boot verifies a signed image. Done:
+     `a_bent_supervisor_is_refused_and_the_other_slot_boots` boots QEMU's
+     AArch64 machine too.
    - `ed25519-dalek` and the loader's `sha2` leave `Cargo.lock`'s non-dev
-     packages.
+     packages. Done (#1019).
+   - **One verdict differs from `verify_strict`, for the owner to accept or
+     refuse:** the crate refuses a public key whose y is p or more, as
+     RFC 8032 section 5.1.3 requires, where `verify_strict` accepts it when
+     the point is not small-order. Every key the tree verifies against is one
+     its build minted, which is canonical, so no verdict on a key the tree
+     holds differs (`lib/update/tests/ed25519_oracles.rs` names the
+     encodings).
 
 ## Weaknesses until the exits hold
 

lib/crypto/tests/data/ed25519_speccheck_cases.json

@@ -0,0 +1 @@
+[{"message":"8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6","pub_key":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa","signature":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a0000000000000000000000000000000000000000000000000000000000000000"},{"message":"9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79","pub_key":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa","signature":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43a5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"},{"message":"aebf3f2601a0c8c5d39cc7d8911642f740b78168218da8471772b35f9d35b9ab","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa8c4bd45aecaca5b24fb97bc10ac27ac8751a7dfe1baff8b953ec9f5833ca260e"},{"message":"9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"9046a64750444938de19f227bb80485e92b83fdb4b6506c160484c016cc1852f87909e14428a7a1d62e9f22f3d3ad7802db02eb2e688b6c52fcd6648a98bd009"},{"message":"e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"160a1cb0dc9c0258cd0a7d23e94d8fa878bcb1925f2c64246b2dee1796bed5125ec6bc982a269b723e0668e540911a9a6a58921d6925e434ab10aa7940551a09"},{"message":"e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"21122a84e0b5fca4052f5b1235c80a537878b38f3142356b2c2384ebad4668b7e40bc836dac0f71076f9abe3a53f9c03c1ceeeddb658d0030494ace586687405"},{"message":"85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40","pub_key":"442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623","signature":"e96f66be976d82e60150baecff9906684aebb1ef181f67a7189ac78ea23b6c0e547f7690a0e2ddcd04d87dbc3490dc19b3b3052f7ff0538cb68afb369ba3a514"},{"message":"85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40","pub_key":"442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623","signature":"8ce5b96c8f26d0ab6c47958c9e68b937104cd36e13c33566acd2fe8d38aa19427e71f98a473474f2f13f06f97c20d58cc3f54b8bd0d272f42b695dd7e89a8c22"},{"message":"9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f"},{"message":"9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908"},{"message":"e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b","pub_key":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","signature":"a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"},{"message":"39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f","pub_key":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","signature":"a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"}]