nx_p256_scalar_mul.nx

nx_p256_scalar_mul.nx -- P-256 scalar multiplication k * P. Phase 0b §I.3 piece 2c of the ECDSA-P256 arc: ✓ 2b. p256_point_add (190acf1f) ✓ 2c. p256_scalar_mul (THIS commit) - 3. p256_scalar mod n (queued) - 4. ecdsa_p256 verify (queued) Algorithm: binary double-and-add, left-to-right (MSB-first): result := O (infinity) for bit_pos = 255 down to 0: result := double(result) if bit_pos-th bit of k is set: result := add(result, P) return result Cost: 256 doublings + up to 256 adds. For a typical 256-bit scalar (~128 set bits), roughly 256 doubles + 128 adds = 384 point ops. Each point op composes ~10-15 field ops; with our slow field_mul at ~4100 limb-ops, one scalar-mult is roughly ~20-25M limb-ops, or ~2-3s on qemu-riscv64-static. ECDSA verify needs TWO scalar mults (u1*G + u2*Q). Shamir's trick (compute both via one shared doubling chain by walking the bits of u1 and u2 in lockstep against a 4-element precomputed point table {O, G, Q, G+Q}) is an optimization queued for a follow-up. For first-cut correctness this commit ships the simpler standalone scalar_mul. Public API: p256_scalar_mul(out, k_8, p) -- k_8: 8-limb 256-bit scalar (LE limb order, MUST be < n in practice but no defensive check here -- caller's ECDSA verify already reduces u1, u2 mod n) -- p: input point (Jacobian) -- out: result point (Jacobian); MAY alias p Edge cases handled: - k == 0: returns O (infinity)