nx_ed25519_point.nx

nx_ed25519_point.nx -- Edwards-curve point ops (RFC 8032 §5.1.3 + §6). Phase 0b §I.1 Piece 2 of the Ed25519 completion arc per docs/NISHI_TLS13_GAP_AUDIT.md. Builds on the field primitives shipped in nx_ed25519_field (T7); supplies the point representation + decompression that Piece 3 (scalar mul) and Piece 4 (verify + sign) need. Point representation (RFC 8032 §5.1.3, extended coords): GeP3 = (X, Y, Z, T) where the affine point is (X/Z, Y/Z) and the auxiliary T = X*Y/Z is precomputed for the fast Edwards-curve addition formulas. Curve equation (twisted Edwards, a = -1): -x^2 + y^2 = 1 + d*x^2*y^2 (affine) -X^2 + Y^2 = Z^2 + d*X^2*Y^2/Z^2 (projective) What it does today: - GeP3 struct (4 fe pointers) + allocator - ge_p3_decompress: 32-byte compressed pubkey -> GeP3 - ge_p3_validate: verify a GeP3 actually lies on the curve (defensive sanity check for KAT) What it doesn't do yet: - ge_p3_add / ge_p3_double (Piece 3) - scalar mul (Piece 3) - point encoding back to 32 bytes (small, ships when needed) KAT verified: - decompress RFC 8032 §7.1 TEST 1 pubkey (d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a) -> resulting point satisfies the twisted Edwards equation - decompress an obviously-bad pubkey (all 0xff after sign bit stripped, which is y > p) is rejected - high-bit sign flip: decompress, then flip the sign bit and decompress again -> get a DIFFERENT point (X coordinate negated) but Y is the same Composes with: - nx_x25519 (fe_alloc / fe_copy / fe_zero / fe_one / fe_add /