nx_tls12_ske_verify_gate.nx

nx_tls12_ske_verify_gate.nx -- SOVEREIGN gate for TLS 1.2 ECDHE-RSA ServerKeyExchange signature verification (nx_tls12_ske_verify.nx). FIXTURE (self-built, NOT a published vector -- there is no published KAT for a TLS ServerKeyExchange): generated by openssl (scratchpad gen_ske_fixture.sh) - RSA-2048 leaf key (e=65537), modulus MOD below - client_random = 00..1f, server_random = 20..3f (deterministic) - ECDHE_params = 03 0017 41 || real secp256r1 uncompressed point (69 B) - SIG = openssl `dgst -sha256 -sign` over client_random||server_random||params (RSASSA-PKCS1-v1_5, 256 bytes); openssl `-verify` reports "Verified OK". openssl SIGNS; this sovereign NishiLang gate VERIFIES -- a cross-implementation check of our RSA PKCS1-v1.5+SHA-256 path against OpenSSL's signer. Checks: 1. verify PASSES against the genuine openssl signature. 2. neg-control: flip one signature byte -> verify FAILS. 3. neg-control: flip one server_random byte (signed data) -> verify FAILS. 4. neg-control: flip one ECDHE point byte (signed params) -> verify FAILS. 5. wire path: parse a full SKE body (params||sigalg||siglen||sig) + verify -> PASSES. 6. wire neg-control: corrupt a point byte in the body -> verify FAILS. expect_exit: 0 license_tier: ORIGINAL