zeekay c90f574601 pqrns: real hybrid identity + sign/verify + E2E test + example ...

Decomplected, one-way-only surface:

  pkg/identity  hybrid identity wire layout — Ed25519 || X25519 ||
                ML-DSA-65 || ML-KEM-768. PublicIdentitySize = 3200 B,
                Fingerprint = first 16 B of SHA-256(identity blob)
                matching native RNS shape. Single Generate / Sign /
                Verify surface; both legs (Ed25519 AND ML-DSA-65)
                must pass for a hybrid signature to verify.

                Domain-separation context strings exported as
                constants (PQRNS-LINK-v1, PQRNS-IDENTITY-SIG-v1,
                PQRNS-ANNOUNCE-SIG-v1, PQRNS-LINK-REKEY-v1) — no two
                layers share a transcript.

  pkg/link      3-packet hybrid-link wire format surface (LinkRequest /
                LinkAccept / LinkActivate / Session). Marshalling +
                KEM/sig wiring lands in the next commit alongside KAT
                vectors + round-trip tests. The surface is fixed now
                so call sites can be wired ahead.

  _examples/basic  hybrid sign/verify demo: generates two identities,
                   prints their fingerprints, signs+verifies under the
                   PQRNS-IDENTITY-SIG-v1 context, demonstrates that a
                   different context refuses to verify (domain
                   separation enforced).

E2E identity tests:
  TestGenerateAndSign      hybrid sign + verify positive
  TestGenerateAndSign      wrong context refuses
  TestGenerateAndSign      tampered digest refuses
  TestFingerprintStable    deterministic from same key
  TestFingerprintsDiffer   two fresh identities don't collide

2026-05-12 19:52:43 -07:00

..

link.go

pqrns: real hybrid identity + sign/verify + E2E test + example

2026-05-12 19:52:43 -07:00