nx_ecdsa_p256.nx

nx_ecdsa_p256.nx -- ECDSA signature verification over NIST P-256. Phase 0b §I.3 FINAL piece of the ECDSA-P256 arc: ✓ 0. u256 big-int (6ff89dd8) ✓ 1. p256_field add/sub/neg (133f16a1) ✓ 1b. u256 wide multiplication (ddb0994a) ✓ 1c. p256_field mul + sq (d295c0a3) ✓ 1d. p256_field inverse (48e8e69d) ✓ 2. p256_point double + on_curve + to_affine (ecc7ad5f) ✓ 2b. p256_point_add (190acf1f) ✓ 2c. p256_scalar_mul (also shipped earlier) ✓ 3. p256_modn (Z/nZ arithmetic) (7e836066) ✓ 4. ecdsa_p256_verify (THIS commit) This is the primitive that x509_validate's signature dispatch will call for ECDSA-signed certs -- including every modern Web PKI cert chain (google.com, Cloudflare, ~80% of the Web). Algorithm (FIPS 186-5 §6.4.2 / SEC 1 v2.0 §4.1.4): Input: pubkey Q = (Qx, Qy) (affine point on curve, != O) msg hash e (256-bit, already truncated/computed) signature (r, s) -- both 256-bit 1. Verify 1 <= r < n and 1 <= s < n. Reject otherwise. 2. Verify Q is on the curve. Reject otherwise. 3. e_n = e mod n (truncate-and-reduce; SHA-256 output has the same bit-length as n for P-256 + SHA-256, so this is just a conditional subtract.) 4. s_inv = s^(-1) mod n 5. u1 = (e_n * s_inv) mod n 6. u2 = (r * s_inv) mod n 7. R = u1 * G + u2 * Q 8. Reject if R = O (point at infinity). 9. Convert R to affine; v = x_R mod n 10. Accept iff v == r. Public API: nx_ecdsa_p256_verify(pub_x, pub_y, hash_e, sig_r, sig_s) -> verdict