Milestone 6 (ACL/PKI): Ed25519 verify + SHA-512, built from scratch

New freestanding, verify-only Ed25519 (RFC 8032) implementation:
include/starkernel/{sha512,fe25519,scalar25519,ed25519}.h +
src/starkernel/crypto/{sha512,fe25519,scalar25519,ed25519}.c, wired into
Makefile.starkernel. Kernel never signs or generates keys -- only
ed25519_verify() is needed; signing happens in the host-side mkcapsule
build tool via libsodium/OpenSSL.

Confirmed __int128 multiply/add/shift-by-constant compile with zero
undefined symbols on all three target toolchains (only division needs
libgcc's __udivti3, per timer.c's existing documented finding -- that
file's comment updated to narrow the claim, since it had been read as
"avoid __int128 entirely"). This enabled the standard 5-limb radix-2^51
field arithmetic representation.

An abandoned first attempt (10-limb radix-2^26, avoiding __int128 out of
premature caution) hit two real bugs, both invisible on inspection and
found only by property-based testing against Python's own bignum
arithmetic: a non-uniform-radix limb misalignment in multiplication, and
a double-counted carry. Verification chain: SHA-512 against known +
boundary vectors (7/7); field arithmetic property-tested 25,045 cases;
scalar-mod-L arithmetic 300 cases (L confirmed prime via Miller-Rabin
first); full verify() end-to-end against 110 real signatures from
Python's cryptography library, including tampered inputs and the RFC
8032 S>=L malleability attack -- all correctly accepted/rejected.

Compiles clean (zero warnings) and links on all three architectures,
confirmed via the mandatory three-arch QEMU boot. The code is linked but
not yet called from anywhere -- wiring into capsule_birth.c needs a
from-scratch X.509/DER parser first (Captain Bob chose real X.509 over a
raw-blob cert format this session), which is the next open item.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZ8kNoTuP63pbQtro4qvrm

src/starkernel/crypto/scalar25519.c

@@ -0,0 +1,74 @@
+/* scalar25519.c -- see scalar25519.h. */
+#include "starkernel/scalar25519.h"
+#include <string.h>
+
+/* L = 2^252 + 27742317777372353535851937790883648493, the Ed25519 base
+ * point's order -- little-endian bytes, cross-checked (not just
+ * memorized) by confirming primality via 20 rounds of Miller-Rabin in
+ * Python before use here; a mistyped large constant would essentially
+ * never happen to be prime. */
+static const uint8_t L_BYTES[32] = {
+    0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
+    0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
+};
+
+/* big[] is a 512-bit (64-byte) little-endian number; returns bit i
+ * (0 = LSB of byte 0). */
+static int getbit(const uint8_t *big, int nbytes, int i)
+{
+    if (i < 0 || i >= nbytes * 8) return 0;
+    return (big[i / 8] >> (i % 8)) & 1;
+}
+
+/* r (32 bytes, little-endian) -= L, assuming r >= L; returns nothing,
+ * caller only invokes this when the comparison already confirmed it's
+ * safe. Plain byte-wise borrow subtraction. */
+static void sub_L(uint8_t r[32])
+{
+    int borrow = 0;
+    for (int i = 0; i < 32; i++) {
+        int v = (int)r[i] - (int)L_BYTES[i] - borrow;
+        if (v < 0) { v += 256; borrow = 1; } else { borrow = 0; }
+        r[i] = (uint8_t)v;
+    }
+}
+
+static int cmp32(const uint8_t a[32], const uint8_t b[32])
+{
+    for (int i = 31; i >= 0; i--) {
+        if (a[i] != b[i]) return (a[i] < b[i]) ? -1 : 1;
+    }
+    return 0;
+}
+
+int scalar_lt_L(const uint8_t s[32])
+{
+    return cmp32(s, L_BYTES) < 0;
+}
+
+void scalar_reduce512(uint8_t out[32], const uint8_t in[64])
+{
+    /* Binary long division: process the 512-bit input from the most
+     * significant bit down, maintaining a running remainder r (< L
+     * always, after each step) -- r = (r*2 + next_bit) mod L, applying
+     * one conditional subtraction of L per bit since r*2+bit is always
+     * < 2L when r was already < L. 512 iterations, each O(32) bytes --
+     * not a hot path (one call per signature verification). */
+    uint8_t r[32] = {0};
+    for (int i = 511; i >= 0; i--) {
+        /* r <<= 1 (with carry across the 32-byte array) */
+        int carry = 0;
+        for (int j = 0; j < 32; j++) {
+            int v = (r[j] << 1) | carry;
+            carry = (v >> 8) & 1;
+            r[j] = (uint8_t)v;
+        }
+        r[0] |= (uint8_t)getbit(in, 64, i);
+        if (cmp32(r, L_BYTES) >= 0) {
+            sub_L(r);
+        }
+    }
+    memcpy(out, r, 32);
+}