Wycheproof wave 6: ECDSA secp256k1, Ed448, AES-CMAC

[paul-hammant]

Stacked on #1924 (compiler/warn-malloc-literal-struct-cast) — review/merge
that first; this branch's diff is only the wave-6 files.

Extends the Wycheproof adversarial-vector program to three implemented
primitives that had no coverage. All pass with no accepted forgeries.

ECDSA secp256k1 (DER + P1363)

The Bitcoin/Ethereum curve. DER runs through the real parse path
(tls13_cert.split_ecdsa_sig, coord 32) then secp256k1.ecdsa_verify — the
same DER-malleability surface wave 3 hardened for P-256; P1363 feeds raw r‖s to
the verifier for r/s-range and modular edge cases.

Ed448 signature verify

The decode/verify surface the ed25519 driver's tc151 forgery lived in
(non-canonical point encodings, small-order/identity points, s out of range,
wrong-length inputs), now covered for the larger curve. ed448.verify hashes
internally, so the message is passed raw.

AES-CMAC (RFC 4493)

Tag verification: recompute over (key, msg), truncate to the group tagSize,
compare. Forged/truncated tags reject; illegal key lengths (the 0/8/64/160/320-bit
groups) are rejected without invoking cmac on an unsupported key. Full sweep —
all 311 cases (63 valid matched, 248 rejected).

Harness budgets

• AES-CMAC: symmetric-fast, full sweep by default.
• ECDSA secp256k1 (test_wycheproof_ecdsa_secp256k1.sh): bignum-heavy (~2s/verify),
  stride 10, ~46s for both forms.
• Ed448 (~4s/verify) shares a slot with CMAC (test_wycheproof_ed448_cmac.sh),
  stride 4, ~49s together.
• WYCHEPROOF_FULL=1 sweeps all. New wp_*.ae are covered by the existing
  tests/integration/wycheproof/ prune-prefix.

Vectors vendored byte-identical from C2SP/wycheproof at the pin already recorded
for wave 5 (3fa63dd).

🤖 Generated with Claude Code

[paul-hammant]

Rebased onto current origin/main now that #1924 (the lint + std sweep this was stacked on) has merged (facb70e7). The branch is a single clean commit over main — just the wave-6 files — and its CHANGELOG entry sits under [current] alongside #1924's merged entries with no duplication.

Re-verified on the rebased base: drivers build and pass (secp256k1, ed448, aes_cmac all ALL PASS), ae fmt gate clean. Ready for review whenever you have a moment. 🙂