nx_ed25519_field.nx

nx_ed25519_field.nx -- Ed25519-specific extensions to the shared GF(2^255 - 19) field math already in nx_x25519. Phase 0b §I.1 Piece 1 of the Ed25519 completion arc per docs/NISHI_TLS13_GAP_AUDIT.md. X25519 and Ed25519 share the same prime field (Curve25519 is the Montgomery form; Ed25519 uses the birationally equivalent twisted Edwards form), so the fe_add / fe_sub / fe_mul / fe_sq / fe_invert / fe_from_bytes / fe_to_bytes operations already in nx_x25519 transfer directly. This module adds the bits Ed25519 needs that X25519 doesn't: - fe_neg : h = -f mod p (used in point ops + sign handling) - fe_pow22523: z^((p-5)/8) (used in sqrt + decompression) - ED25519_D : the twisted-Edwards curve parameter d - ED25519_SQRT_M1 : the field element with x^2 = -1 (used in point decompression to pick the right square root) Subsequent pieces: - Piece 2 SHIPPED T8: nx_ed25519_point.nx with GeP3 + decompress + on-curve check. Add + double + scalar_mul queued for Piece 3. - Piece 3: ge_p3_add + ge_p3_double + sc_reduce mod L + scalar mul primitives. - Piece 4: nx_ed25519.nx's ed25519_verify replaces its ERR_PENDING stub with real wiring + ed25519_sign + RFC 8032 §7.1 KATs. What it does today: - fe_neg / fe_pow22523 / ED25519_D / ED25519_SQRT_M1 - sealed verdict + validity gate for the small ed25519 verdict namespace that piece 3 will populate What it doesn't do yet: - sqrt extraction (composes pow22523 + sqrt_m1; ships Piece 2) - any point operations KAT verified: - fe_neg(fe_one) + fe_one == fe_zero (round-trip) - fe_pow22523(fe_one) == fe_one (1^anything = 1) - ED25519_SQRT_M1^2 == fe_neg(fe_one) (the defining property)