Harden cryptographic primitive contracts

[wangxiao1254]

Summary

Harden the contracts of the runtime cryptographic primitives and correct their benchmark coverage and accounting.

Changes

AES and PRG

• use unsigned AES-CTR counters across the signed boundary;
• reject negative and overflowing runtime dimensions;
• define empty compile-time AES shapes;
• invalidate buffered operator() words on PRG::reseed();
• cover unaligned output, guard bytes, and counter wrap.

CCRH, F2K, and MITCCRH

• validate runtime vector lengths and compile-time hash shapes;
• define empty CCRH vector operations;
• retain typed byte-bool selectors;
• initialize MITCCRH state deterministically.

EC and random oracle

• generate nonzero private scalars;
• add bounded/padded scalar encodings and const-safe BIGNUM access;
• use deterministic test-mode rejection sampling;
• validate output sizes, DST bounds, point encodings, and supported curves;
• clear stale OpenSSL errors before retryable map-to-curve operations.

Half gates and SessionID

• separate the shared public half-gate hash seed from the secret free-XOR delta;
• pin the shared gid schedule and batch-size invariance with tests;
• mark SessionID::derive() [[nodiscard]] and document copy/counter behavior.

Benchmarks

• prevent runtime AES work from being hoisted;
• report active SIMD tiers;
• correct F2K byte/cycle and half-gate gate accounting;
• use aligned PRG storage and cover alignment/size boundaries;
• compare MITCCRH in-place, out-of-place, and unaligned-gid shapes.

The benchmark changes make the existing measurements faithful.

Compatibility

The stricter size/shape contracts fail before pointer arithmetic. Scalar::n() becomes const-safe, and half-gate callers must provide the same public hash seed to garbler and evaluator independently of the delta.

Tests

• clean Apple Clang 17 Release/Ninja build completed;
• full CTest suite: 72/72 passed;
• focused AES, PRG, CCRH, F2K, MITCCRH, ECC, RO, half-gate, SessionID, and no-exceptions suite: 10/10 passed;
• expected AES/crypto compile-failure contracts: 16/16 passed;
• portable Release (EMP_TOOL_NATIVE_ARCH=OFF): focused suite 10/10 and compile-failure contracts 16/16 passed.

Coverage includes AES and crypto compile-fail probes, AES/PRG/CCRH/F2K/MITCCRH boundary and reference tests, EC/RO malformed-input tests, exhaustive half-gate truth tables, seed/gid invariants, and SessionID derivation streams.

Stack

This is PR 4 of 6 and targets audit/core-contracts.