ed25519.nx

ed25519.nx -- Ed25519 signature verification (RFC 8032). VERIFY-ONLY. Signing requires a private key and constant-time scalar reduction we can defer to a later implementation. TLS 1.3 clients verify server cert signatures; they never sign. This is the piece that closes the cert-chain verify gap when paired with x509.nx + sha512.nx. Algorithm: Input: signature (64 bytes = R || S) public key A (32 bytes = compressed Edwards point) message m (arbitrary length) Output: 1 if signature is valid, 0 otherwise. Verify: 1. Decode R from first 32 bytes (Edwards point, y-coordinate with high bit = sign of x). 2. Decode S from last 32 bytes (little-endian scalar, must be < L; otherwise reject). 3. Decode A from public key bytes. 4. Compute h = SHA-512(R_bytes || A_bytes || m) mod L. 5. Compute [S]G - [h]A; if result == R then signature is valid. (Equivalent: [S]G == R + [h]A.) Where: G is the Ed25519 base point. L = 2^252 + 27742317777372353535851937790883648493 (order of G). Curve: twisted Edwards form -x^2 + y^2 = 1 + d*x^2*y^2 where d = -121665/121666 (mod p), p = 2^255 - 19. Relationship to x25519.nx: Same field GF(2^255-19). We re-declare the fe_* operations here because NishiLang currently has no way to share types across imported modules without declaration collisions (the types.nx pattern requires one canonical home). A later refactor can factor GF(p) into its own module. Scope: This ships the SKELETON + scalar reduction mod L. Full point