Migrate composite algorithms to draft-19 sigs / draft-15 KEM

[megha-seventhsense]

Summary

Migrates QuantCrypt's composite algorithms to the IETF Hackathon "latest" — draft-ietf-lamps-pq-composite-sigs-19 and draft-ietf-lamps-pq-composite-kem-15 — moving off the old draft‑03‑era construction and the experimental Entrust OID arc (2.16.840.1.114027.80.*) to the production IANA arc (1.3.6.1.5.5.7.6.37–.66). Every composite algorithm is verified byte‑for‑byte against the hackathon reference implementations.

What changed

Algorithms & OIDs

• Production OIDs 1.3.6.1.5.5.7.6.37–.54 (18 composite signatures) and .55–.66 (12 composite KEMs).
• New algorithms: MLDSA65-ECDSA-P256, MLDSA87-RSA3072-PSS, MLDSA87-RSA4096-PSS, MLDSA87-ECDSA-P521 (sigs); MLKEM768-ECDH-P256, MLKEM1024-RSA3072, MLKEM1024-ECDH-P521 (KEM).
• New P‑521 curve support (DSA + KEM). Removed the superseded HashMlDsa*Composite variants — draft‑19 has a single, always pre‑hashed set.

Cryptographic constructions

• Signature: M' = Prefix("CompositeAlgorithmSignatures2025") || Label || len(ctx) || ctx || PH(M), with the per‑algorithm COMPSIG-* label used as the ML‑DSA context. Correct per‑algorithm pre‑hash, incl. SHAKE256/64 for MLDSA87-Ed448.
• KEM combiner: SHA3-256(mlkemSS || tradSS || tradCT || tradPK || Label) — uniform SHA3‑256 with per‑algorithm labels.

Serialization (draft‑19/‑15 raw concatenation, replacing the old SEQUENCE encodings)

• Public key pqPK || tradPK, signature mldsaSig || tradSig, KEM ciphertext mlkemCT || tradCT — split on the fixed PQ component length.
• Private key (PKCS#8) pqSeed || tradSK: seed‑based keygen (mldsaSeed 32 B, mlkemSeed 64 B = d‖z) and component‑appropriate tradSK encodings (RSA PKCS#1, Ed/X raw, EC RFC‑5915 ECPrivateKey). The combiner's tradPK is recomputed from the secret key on decap (draft‑15 keys don't store it).

Verification

All checks pass against the IETF Hackathon R5 reference implementations (composite-sigs-ref-impl, composite-kem-ref-impl), added under test/data/r5_interop/:

Gate	What it proves
test_r5_composite_sig_interop	18 composite + 3 pure reference self‑signed certs verify
test_r5_composite_sig_privkey_interop	18 reference private keys load, sign, and verify against their anchors
test_r5_composite_kem_interop	Encapsulate to all 12 reference composite KEM public keys
test_r5_composite_kem_privkey_interop	12 reference private keys decapsulate _ciphertext.bin to exactly the reference _ss.bin
test_kem_combiner_vector_mlkem768_p256	KEM combiner matches the draft‑15 Appendix E vector byte‑for‑byte

• 158 unit tests pass, cargo clippy --all-targets clean.
• Regenerated the R5 hackathon artifacts under artifacts/r5_certs/.

Notes

• Breaking API change: the HashMlDsa*Composite DsaAlgorithm variants were removed (superseded by draft‑19's single set). Acceptable for this 0.x, testing‑oriented crate.
• Old R4 composite interop (superseded Entrust‑arc draft) is intentionally skipped; composite interop is now validated against R5.

🤖 Generated with Claude Code

Cross-provider validation (independent third-party artifacts)

Beyond the reference implementation, the composite implementation is validated against green R5 artifacts submitted by five independent third parties — Bouncy Castle, Entrust, Crypto4A, CryptoNext, and leancrypto (test_r5_cross_provider_interop, corpus under test/data/r5_interop/providers/). For each provider we verify every composite signature self-signed cert, sign+verify with every composite signature private key against that provider's trust anchor, and decapsulate every composite KEM ciphertext to exactly that provider's expected shared secret.

Provider	Sig certs + priv keys	KEM decap == expected ss
Bouncy Castle (bc)	18/18	12/12
Entrust	18/18	12/12
Crypto4A	18/18	12/12
CryptoNext	18/18	12/12
leancrypto	3/3	— (none submitted)

Total: 75 signature checks + 48 KEM decapsulation checks across 5 independent implementations, zero failures. 159 unit tests pass; clippy clean.