nx_p256_field.nx

nx_p256_field.nx -- NIST P-256 prime field arithmetic. Phase 0b §I.3 piece 1 of the ECDSA-P256 arc. Composes the nx_u256 big-int primitives (commit 6ff89dd8) with the P-256 prime p = 2^256 - 2^224 + 2^192 + 2^96 - 1 = FFFFFFFF 00000001 00000000 00000000 00000000 FFFFFFFF FFFFFFFF FFFFFFFF (big-endian) into modular add / subtract / negate primitives operating on F_p elements in canonical form (each element in [0, p)). Public API: p256_field_load_p(out) -- write the prime into a buffer p256_field_zero(out) / p256_field_one(out) p256_field_copy(out, src) p256_field_eq(a, b) -> 0|1 p256_field_add(r, a, b) -- r = (a + b) mod p p256_field_sub(r, a, b) -- r = (a - b) mod p p256_field_neg(r, a) -- r = (-a) mod p nx_p256_field_verdict_is_valid(v) Preconditions: callers MUST pass operands already reduced to canonical form [0, p). All outputs are guaranteed canonical. What this primitive does NOT do (queued for §1b): - Multiplication (schoolbook 8x8 = 16 limbs, then Solinas reduction using p's special form). - Squaring (mul fast path). - Modular inverse (Fermat: a^(p-2) mod p, ~256 squarings + ~30 muls). - These are bigger arcs; add/sub/neg ship first because every point operation uses them and they're well-defined alone. Algorithm references: - FIPS 186-5 §D.2.4 (P-256 prime + base point + group order) - SEC 1 v2.0 §2.2.1 (Weierstrass curve over F_p form) - HAC §14.2.1 (modular add/subtract conditional steps) - BoringSSL p256.c (modern u32-limb reference for layout)