#experimental_crypto

Status: experimental — not for production. This workspace exists to fill gaps in the MoonBit ecosystem so other people writing MoonBit code have something to read and reuse. None of the modules have been independently audited. Constant-time discipline, side-channel resistance, and on-wire format edge cases are documented but not certified.

If you use any of this code in a real system, you are responsible for reviewing the source first and confirming it meets your security requirements. The author disclaims all liability for use. Prefer a vetted library (RustCrypto, dalek, BoringSSL, etc.) wherever one exists for your protocol.

#Packages and RFC coverage

#Cross-implementation interop

• pkix parses the live Let's Encrypt R10 intermediate CA (PEM embedded in pkix/fixtures_test.mbt) and round-trips it byte-stable.
• pkcs8 parses the Ed25519 PKCS#8 v1 + v2 PEM fixtures from RustCrypto/formats, including the v2 "Curdle Chairs" attribute from RFC 8410 §10.3.
• aead, ed25519, x25519, p256, p384, p521, secp256k1, and rsa include Wycheproof or Wycheproof-derived vectors where the workspace has matching algorithm support.
• jwt, jwe, cose, pkcs8, pbkdf2, scrypt, and hash include reference or platform-oracle tests against external implementations.
• pkix_verify replays in-scope subsets of the C2SP/x509-limbo and Netflix BetterTLS certificate-path-validation suites (testdata/x509-limbo, testdata/bettertls, generated by scripts/gen_x509_limbo.py); the harness fails if any chain that should be rejected verifies.

#Git commit signing

1. Read git cat-file commit <rev> bytes.
2. Parse the object with @git_object.parse_signed_commit.
3. Verify signed.signature_armor over signed.signed_content with @ssh, @pgp, or @cms.

#Build

moon test                                       # all sub-packages
moon test --target all                          # wasm-gc + wasm + native
moon test -p mizchi/experimental_crypto/asn1    # single sub-package
moon bench --release -p mizchi/experimental_crypto/x25519
moon check --target all

#Performance baselines

#Known limitations

• Not constant-time end-to-end. crypto_bigint, RSA private modexp, and ECDSA sign-side scalar multiplication mostly use fixed-limb / fixed-iteration paths, Linux-native leakage smoke gates, and loose JS / wasm-gc / wasm backend smoke checks, but this is still not a constant-clock proof. P-521 sign-side paths are wired into the leakage harness but still need repeated calibrated evidence before a measured-candidate claim. See docs/CONSTANT_TIME.md.
• Partial protocol coverage. TLS 1.3, PKCS#12, Ed448 / X448, ML-KEM / ML-DSA, AES-GCM-SIV / AES-SIV, age, and EIP-712 / EIP-191 are not implemented.
• Revocation scope is conservative. OCSP and CRL parsing / verification exist, but unsupported delta / indirect / distribution-point semantics are rejected fail-closed rather than silently applied.
• No GHASH carryless-multiplication intrinsic. The gcm module uses a portable 4-bit Shoup table, not hardware CLMUL / SIMD.

#License

#Layout

.
├── moon.mod                # single module manifest (mizchi/experimental_crypto)
├── README.md               # this file
├── .gitignore
└── <subpkg>/
    ├── moon.pkg            # package imports, native stubs, target maps
    ├── <subpkg>.mbt        # main source
    ├── <subpkg>_test.mbt   # blackbox tests
    ├── <subpkg>_wbtest.mbt # whitebox tests (where useful)
    └── pkg.generated.mbti  # public API snapshot, regenerated by `moon info`

#Security Disclaimer ⚠️

• An educational reference implementation
• Experimental cryptography software
• Not reviewed by third-party security experts

#What review has happened

• Negative test corpus. Each parser / verifier ships ATTACK … tests that pin reject behaviour (signature forgery, DER parser confusion, JWT algorithm confusion, CMS content-swap, padding edge cases). The X.509 path verifier is swept against the x509-limbo corpus (scripts/gen_x509_limbo.py in CI, scripts/audit_x509_limbo.py for the full ~2200-case one-shot) and every accepted reject case is documented as out-of-scope-by-design, with zero known false positives.
• Verification-bypass review. RSA PKCS#1 v1.5 verify is encode-then-compare (no DigestInfo parser to fool); ECDSA rejects r,s ∉ [1,n-1]; Ed25519 enforces canonical S; JWT binds alg to the key type and has no alg=none path; the PKIX chain validator is fail-closed (every failure raises, the only success is falling through the whole pipeline). AEAD tags are compared in constant time and plaintext is withheld until the tag verifies.

#Before you use any of this in a real system

1. Read the source for the specific module and confirm it meets your threat model — side-channel / timing resistance is not certified (see Known limitations and docs/CONSTANT_TIME.md).
2. Prefer a vetted library (RustCrypto, dalek, BoringSSL, …) wherever one exists for your protocol.
3. Commission an independent audit before depending on it for anything that protects keys, identities, or user data.