feat(picky-crypto): add the RustCrypto backend

[Benoît Cortier (CBenoit)]

Implementing the picky-crypto contract needs at least one software backend. RustCrypto covers every contract algorithm except the key-based KDFs and FFDH, and it includes the legacy algorithms NTLM, Kerberos and legacy PKCS#12 need.

Add the picky-crypto-rustcrypto crate (publish = false). It is a thin adapter: each entry maps the contract's arguments to RustCrypto calls, checks algorithm-fixed lengths and constant bytes, and maps library errors to the contract's error set. Library capabilities the adapter relies on are cited at their locked versions in code comments. fips() is always false. Library zeroize features are enabled, and adapter-held secret copies and returned buffers use zeroizing storage. No secret-holding type implements Debug.

Algorithm families are features, with nothing enabled by default. A build without features yields an empty provider, and each feature only adds entries:

• digest: SHA-1, SHA-2 and SHA3-384/512 hashes, HMAC and PBKDF2
• aes: AES-CBC
• aead: AES-GCM
• key-wrap: AES-KW
• rsa: PKCS#1 v1.5 signature verification (MD5, SHA-1, SHA-2, SHA3-384/512), PKCS#1 v1.5 and OAEP encryption, private-key loading, 2048/3072/4096-bit generation
• nist-ec: ECDSA and ECDH on P-256, P-384 and P-521, private-key loading and generation
• curve25519: Ed25519 verification, loading and generation; X25519 ephemeral and static agreement
• legacy: MD4, MD5, RC4, 3DES-EDE3-CBC and RC2-CBC
• all: every family (64 entries)

A secure-random entry comes with aead, rsa, nist-ec or curve25519. Key-based KDFs and FFDH are not provided; other providers supply them.

Where the library falls short of the contract, the adapter uses library functions only:

• RSA key generation expands a 256-bit OS seed with ChaCha20, because the library's generator interface cannot report a randomness failure.
• Ephemeral X25519 fills its scalar from the OS generator, because the library's ephemeral type panics on randomness failure.
• Ed25519 verification rejects non-canonical public-key encodings, which the library accepts (ZIP-215), by comparing the library's recompression with the input.
• RSA keys beyond the library's size or exponent limits return Unsupported.

RSA signing and decryption are blinded, and ECDSA signing mixes OS randomness into the RFC 6979 nonce.
picky-crypto-rustcrypto/deny.toml bans ed25519-dalek's legacy_compatibility feature over the workspace, because it would weaken the Ed25519 S range check through feature unification.

CONTRACT.md clarifications motivated by this backend:

• §4: library key-validation failures map to InvalidKey, except when the library only rejects a well-formed key for its size or parameters, which maps to Unsupported.
• §7 and §12: handling RSA private keys with non-distinct primes (p = q) is implementation-defined, per call, and has no conformance vector.

The picky-crypto-conformance runner gains a rustcrypto feature that registers this provider with all. CI runs it, together with a depth-2 cargo-hack clippy powerset over the backend's features and the cargo-deny feature ban.

The separate fix(picky) commit makes an Ed25519 SignatureEncoding::to_vec call explicit, so workspace clippy passes when ed25519/alloc is unified in. It duplicates a standalone fix against master and drops out when this branch is rebased after that fix lands.

Stacked on #556; merge after it.

Size: backend source +1544 (about 180 of it inline adapter tests), manifests and runner +78, documentation +89/−8, CI +29/−2, Cargo.lock +69 (md4 0.11.0, rc4 0.2.0 and this crate), picky +2/−2.

Open question: rsa is the prerelease 0.10.0-rc.18, which the workspace already locks.

[Copilot]

🟡 Changes recommended

Contract inconsistencies, ECDSA nonce handling, PBKDF2 error mapping, and the prohibited intent-file addition remain unresolved.

5 open findings

• Use backend CSPRNG for ECDSA nonces · New
• Preserve ProviderFailure for must-support PBKDF2 lengths · New
• Do not add INTENT.md; follow the human-owned intent process · New
• Use “need” with the compound subject · New
• Restrict InvalidKey to key-validation failures · New

What changed in this PR

Adds a feature-gated RustCrypto implementation of the picky-crypto provider contract and integrates it with conformance testing and CI.

Changes:

• Implements 64 cryptographic provider entries across eight feature families.
• Clarifies contract error handling and malformed RSA-key behavior.
• Adds conformance, feature-powerset, documentation, and dependency-policy checks.

File	Description
.github/​workflows/​ci.yml	Adds backend conformance and CI checks.
Cargo.lock	Locks backend dependencies.
Cargo.toml	Registers the backend workspace crate.
picky/​src/​signature.rs	Disambiguates signature encoding.
picky-crypto/​CONTRACT.md	Revises error and RSA-key rules.
picky-crypto-conformance/​Cargo.toml	Adds the optional backend feature.
picky-crypto-conformance/​tests/​main.rs	Registers the RustCrypto provider.
picky-crypto-rustcrypto/​AGENTS.md	Adds backend maintenance guidance.
picky-crypto-rustcrypto/​Cargo.toml	Defines features and dependencies.
picky-crypto-rustcrypto/​INTENT.md	Adds backend intent and invariants.
picky-crypto-rustcrypto/​README.md	Documents features and capabilities.
picky-crypto-rustcrypto/​deny.toml	Bans weakened Ed25519 compatibility.
picky-crypto-rustcrypto/​src/​aead.rs	Implements AES-GCM.
picky-crypto-rustcrypto/​src/​cbc.rs	Implements CBC ciphers.
picky-crypto-rustcrypto/​src/​curve25519.rs	Implements Ed25519 and X25519.
picky-crypto-rustcrypto/​src/​ec.rs	Implements NIST EC operations.
picky-crypto-rustcrypto/​src/​hash.rs	Implements digest entries.
picky-crypto-rustcrypto/​src/​key_wrap.rs	Implements AES-KW.
picky-crypto-rustcrypto/​src/​lib.rs	Assembles feature-selected entries.
picky-crypto-rustcrypto/​src/​mac.rs	Implements HMAC.
picky-crypto-rustcrypto/​src/​pbkdf2.rs	Implements PBKDF2.
picky-crypto-rustcrypto/​src/​random.rs	Implements secure randomness.
picky-crypto-rustcrypto/​src/​rc4.rs	Implements RC4.
picky-crypto-rustcrypto/​src/​rsa.rs	Implements RSA operations and keys.
picky-crypto-rustcrypto/​src/​util.rs	Adds zeroizing buffer and length helpers.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The new contract wording misclassifies non-key library validation failures as InvalidKey.

1 open finding

• Restrict InvalidKey to key-validation failures

4 resolved since last review

• Preserve ProviderFailure for must-support PBKDF2 lengths
• Use backend CSPRNG for ECDSA nonces
• Use “need” with the compound subject
• Do not add INTENT.md; follow the human-owned intent process

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

The broad cryptographic and key-handling surface warrants final human security review despite comprehensive conformance coverage.

0 open findings

1 resolved since last review

• Restrict InvalidKey to key-validation failures

🧠 Review effort: Balanced