nx_pbkdf2sha1_extvec_gate.nx

nx_pbkdf2sha1_extvec_gate.nx -- PBKDF2-HMAC-SHA1 vs RFC 6070, ALL SIX published vectors. A NEW AUTHORITY, ACQUIRED THROUGH THE REPAIRED PIPELINE. rfc6070.txt was fetched by nx_vecfetch v2: HTTP status verified, 720 bytes of response envelope stripped, de-chunked, hashed as a DOCUMENT, and the digest CORROBORATED against .NET WebClient before a byte was written (CORROBORATION.tsv). Under v1 this file would have been a wire transcript with Cloudflare headers pinned as "the authority". ★WHY THIS GATE EXISTS: pbkdf2_sha1 is one of the FIVE modules riding the defective sha1.nx core, and it is one of the TWO I originally missed when I filed the defect (I listed hmac/hkdf/hotp and overlooked PBKDF2 and TOTP -- password-based key derivation and two-factor codes, the two with the worst blast radius). ★COUNT THE IMPORT CLOSURE, NOT THE FILES YOU HAPPENED TO GREP. This gate binds `nx_pbkdf2_sha1.nx` -> nx_hmac_sha1.nx -> nx_sha1.nx (the CORRECT family). Both families export the identical symbol `pbkdf2_sha1` with an identical signature, so ★THE ONLY THING THAT DISTINGUISHES THEM IS THE FILE BOUND -- NAME THE FILE, NEVER THE FUNCTION. ⚠THREE READER HAZARDS IN THIS DIALECT, ALL HANDLED EXPLICITLY: 1. P and S are QUOTED ASCII, not hex: P = "password" (8 octets) 2. VECTOR 6 EMBEDS A LITERAL NUL as the two-character sequence \0 : P = "pass\0word" (9 octets) S = "sa\0lt" (5 octets) A reader that copies bytes literally yields 10 and 6 octets and silently tests the wrong input. The declared octet count in the document is what catches this, so it is CROSS-CHECKED on every vector. 3. DK is space-separated hex wrapped across lines and terminated by "(20 octets)". Continuation lines carry no '=' -- the same structural discriminator used elsewhere in this workstream, because "da", "Da" and friends are all valid hex and a lexical test cannot separate a value from a label. ⚠VECTOR 5 COSTS 16,777,216 ITERATIONS (~33.5M SHA-1 compressions). It is RUN, not skipped: the authority published six vectors and grading five while printing GREEN is the coverage-gaming this lane exists to stop. If it must ever be dropped, it must be dropped LOUDLY with its parameters printed -- never silently. license_tier: ORIGINAL expect_exit: 0