nx_ed25519_arith.nx

nx_ed25519_arith.nx -- Edwards-curve point arithmetic (RFC 8032). Phase 0b §I.1.C-1 of the Ed25519 completion arc per docs/NISHI_TLS13_GAP_AUDIT.md. Builds on the field primitives (T7) and point decompression (T8) with the arithmetic that scalar multiplication needs: point doubling, point addition, point negation, identity, and the compressed-form encoder used for equality testing + the public-key wire format. Formulas: Bernstein + Lange "Twisted Edwards Curves Revisited" (Asiacrypt 2008), extended coordinates, a = -1. These are the dbl-2008-hwcd-3 doubling and add-2008-hwcd-3 addition from the Explicit-Formulas Database (EFD), which are the standard reference choices for Ed25519. What it does today: - ge_p3_identity: returns the curve identity (0, 1, 1, 0) - ge_p3_negate: in-place negate (X' = -X, T' = -T) - ge_p3_double: 4M + 4S; consumes only X1, Y1, Z1 (T1 unused) - ge_p3_add: 9M; general extended-coord addition - ge_p3_compress: normalize Z to 1 via fe_invert, encode Y + sign-of-X bit into 32 LE bytes - ge_p3_equal: compare two GeP3 by their compressed encodings What it doesn't do yet: - scalar multiplication (Piece 3b uses double + add to build it) - sc_reduce mod L (Piece 3c; 21-bit limb scalar reduction) - ge_p3_madd (mixed addition with precomputed-form points; a perf optimization, not a correctness requirement) KAT verified: - identity point passes on-curve check - basepoint doubled satisfies the curve equation - basepoint + basepoint == double(basepoint) (verified by compressing both and comparing bytes) - P + (-P) compresses to the identity encoding (32 zero bytes except byte 0 = 0x01; the canonical encoding of y=1, x=0) - encode(decompress(B_compressed)) == B_compressed (round-trip) Composes with: