49dc080c65
refactor!: consolidate crypto architecture and security model
...
* make ZeroEchoSession the sole policy, audit, and runtime boundary
* replace combined key builders with operation-specific SPI and typed metadata
* remove obsolete pre-release compatibility APIs and global crypto operations
* finalize JCA agreement contexts and replace inheritance with composition
* harden secret lifecycle, key destruction, hybrid KEX, PBKDF2, and audit handling
* standardize PairSeq I/O and introduce immutable validated value types
* migrate app, ext, samples, and required pki integration points
* expand correctness, security, concurrency, and malformed-input coverage
BREAKING CHANGE: removes deprecated pre-release global configuration, legacy
context factories, combined key-builder contracts, String-based password APIs,
unchecked PairSeq writing, BlockGeometry public fields, and other compatibility
facades.
2026-07-28 19:20:30 +02:00
e74e833c5b
chore: extract shared classic-leg wiring in HybridKexBuilder
...
Extract duplicated classic-leg construction from
HybridKexBuilder.buildInitiator() and buildResponder()
into a private buildClassicLeg() helper with JavaDoc.
This keeps classic mode validation and context creation
in one place, reduces asymmetry risk between initiator
and responder paths, and preserves existing behavior.
Closes #18 spent @30m
2026-04-05 22:56:47 +02:00
