Benchmark ciris-crypto vs liboqs/OpenMLS (ML-KEM-768 / ML-DSA-65 / TreeKEM)

[emooreatx]

Cross-check ciris-crypto against reference implementations

Per the CEG benchmark/crib work (CIRISRegistry#61) and the CEG 0.15 streaming-standards fold (now conforms to MLS TreeKEM / RFC 9420 + SFrame).

• Run src/ciris-crypto/benches/federation_crypto.rs (criterion) and compare ML-KEM-768 / ML-DSA-65 per-op to liboqs (AVX2). Sanity vs the CEG model figures (X25519 ~23µs vs ML-KEM-768 encaps ~30µs; AES-256-GCM hot path).
• Compare the hybrid_kex / key_grant epoch cascade to OpenMLS TreeKEM rekey (the §10.5.3 conformance target).
• Confirm wrap_algorithm: v2 (X25519+ML-KEM-768) hybrid wrap/unwrap round-trips against KATs.

Crib targets are open source (liboqs MIT, OpenMLS BSD-3). Feeds the CEG 1.0 streaming-feasibility case.

[emooreatx]

Status checkpoint (as of v5.1.0)

• ✅ ML-KEM-768 / ML-DSA-65 per-op + liboqs comparison — benches/federation_crypto.rs ships; the feature-gated bench-liboqs cross-check (AVX2) is in. The crypto-cost numbers behind the "runs on commodity hardware" claim are wired into docs/CEWP_ORIENTATION.md.
• ✅ wrap_algorithm: v2 (X25519+ML-KEM-768) round-trips — covered: key_grant.rs carries the v2 wrap/unwrap tests incl. the HKDF wrap-key byte-stability KAT (key_grant.rs:760).
• 🟡 OpenMLS TreeKEM rekey comparison (the §10.5.3 conformance target) — deferred, feature-gated bench-openmls not yet added.
• 🟡 ML-KEM-768 FIPS 203 final KAT vector verification — deferred.

Keeping open for the two deferred bench phases (OpenMLS + FIPS 203 KAT). These are feasibility/cross-check work, not on any release's critical path — no blocker downstream. Will pick up alongside the next streaming-substrate pass.

[emooreatx]

Phase 4 (ML-KEM-768 FIPS 203 KAT) — done in v5.4.0. A true byte-pinned KAT (not round-trip-only) using the ml-kem crate's FIPS 203 §7 deterministic primitives (from_seed / encapsulate_deterministic), plus determinism + length-invariant + fail-closed tests. New generate_keypair_deterministic / encapsulate_deterministic (KAT/test-only, doc-flagged), feature-gated under ml-kem, 6 tests. Pinned ek/dk/ct/ss SHA-256 digests locked in-module; one-line upgrade path to a NIST ACVP quadruple documented. Phase 3 (OpenMLS TreeKEM bench) remains the open item here.