kxco-post-quantum 1.6.3 → 1.6.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.6.4
+
+Documentation. The npm description said "2,103 NIST ACVP vectors and 225
+interop checks, 0 failed", which reads as 2,103 passing. The evidence records
+2,103 tested, 1,793 passed, 0 failed, 310 skipped, and CONFORMANCE.md says a
+skip is not a pass.
+
+Twelve sibling READMEs were corrected for this yesterday and this package's own
+README has been right for months. The description was the one place it
+survived, and a description only changes when the package is published, so it
+needed a release rather than a commit. It is the first thing anyone reads.
+
+Also corrects the count of what the downloadable bundle contains, from 1,479
+to the 1,551 actually present in the published v1.6.3 assets.
+
 ## 1.6.3
 
 Release plumbing only. No source change.

package/README.md

@@ -36,7 +36,7 @@ languages are **JavaScript and C** (OpenSSL 3.5 on Node 24+).
 
 **Evidence, not adjectives:**
 
-- [CONFORMANCE.md](./CONFORMANCE.md): NIST ACVP vectors for FIPS 203/204/205: **2,103 vectors, 1,793 passed, 0 failed, 310 skipped**, where every skip is this library refusing a pre-hash weaker than the parameter set and is listed individually with its reason. CONFORMANCE.md says a skip is not a pass, so the headline says so too. Of those, **1,479 vectors are in the downloadable evidence bundle**; the remaining 624 are SLH-DSA signature generation, which signs in seconds per operation and so is reproduced on demand with `node conformance/run-acvp.mjs --set SLH-DSA-sigGen-FIPS205` rather than shipped. The bundle names that gap rather than leaving it to be noticed. Plus a cross-implementation interop matrix against liboqs, Bouncy Castle and two pure-Python implementations (225 checks, 0 failed, both directions, with negative controls), run against both backends. Reproducible: `npm run conformance:acvp`, `npm run conformance:interop`.
+- [CONFORMANCE.md](./CONFORMANCE.md): NIST ACVP vectors for FIPS 203/204/205: **2,103 vectors, 1,793 passed, 0 failed, 310 skipped**, where every skip is this library refusing a pre-hash weaker than the parameter set and is listed individually with its reason. CONFORMANCE.md says a skip is not a pass, so the headline says so too. Of those, **1,551 are in the downloadable evidence bundle**, measured from the published v1.6.3 assets: 855 in `02-conformance-acvp.json`, 624 in `02b-conformance-acvp-fips205.json` and a 72-vector sample of SLH-DSA signature generation in `02d-conformance-acvp-fips205-siggen.json`. Signature generation is sampled rather than shipped whole because it signs in seconds per operation; the full set is reproduced on demand with `node conformance/run-acvp.mjs --set SLH-DSA-sigGen-FIPS205`. The bundle names that gap rather than leaving it to be noticed. Plus a cross-implementation interop matrix against liboqs, Bouncy Castle and two pure-Python implementations (225 checks, 0 failed, both directions, with negative controls), run against both backends. Reproducible: `npm run conformance:acvp`, `npm run conformance:interop`.
 - [BENCHMARKS.md](./BENCHMARKS.md): per-algorithm latency at p95/p99 on both backends and on x86-64 and arm64, plus memory. Two figures worth designing around: ML-DSA signing keeps a rejection-sampling tail on either backend (5.1x median-to-p99 in JavaScript, 3.5x on OpenSSL), and SLH-DSA-SHA2-192s signs in seconds rather than milliseconds (4.3 s and 1.7 s).
 - [THREAT-MODEL.md](./THREAT-MODEL.md): what this defends against and what it does not. Read the side-channel section before deciding where a signing key lives.
 - [MIGRATION.md](./MIGRATION.md): moving an RSA or ECDSA system across, and moving between versions of this package.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kxco-post-quantum",
-  "version": "1.6.3",
-  "description": "ML-DSA-65, ML-KEM-768 and SLH-DSA-SHA2-192s with key fingerprinting. OpenSSL 3.5 primitives on Node 24+, JavaScript elsewhere. 2,103 NIST ACVP vectors and 225 cross-implementation interop checks, 0 failed. Reproducible builds and SLSA provenance.",
+  "version": "1.6.4",
+  "description": "ML-DSA-65, ML-KEM-768 and SLH-DSA-SHA2-192s with key fingerprinting. OpenSSL 3.5 primitives on Node 24+, JavaScript elsewhere. 2,103 NIST ACVP vectors: 1,793 passed, 0 failed, 310 skipped. 225 interop checks, 0 failed. Reproducible builds and provenance.",
   "keywords": [
     "post-quantum",
     "pqc",