Checked crypto arithmetic and key agreement
Version 2.955.1 keeps the existing SHA3, SHAKE and key-agreement APIs, with integer overflow and range checks enabled in Delphi and Free Pascal
SHA3-256, SHA3-384, SHA3-512 and SHAKE256 carry on producing their existing outputs across empty inputs, rate boundaries, multiple blocks, streamed updates and repeated SHAKE extraction
P-256, P-384 and P-521 exchanges use explicit low-word operations wherever the field implementation deliberately works modulo 2^64; high-bit constants and Montgomery operations remain usable in checked 32-bit builds
Montgomery shared-secret admission
HPDFX25519 and HPDFX448 examine the complete canonical output bytes and raise EInvalidOpException when the shared secret is all zero, including weak field representations whose internal limbs are non-zero
HPDFComputeKeyAgreementSecret turns this rejection into False, an empty SharedSecret and a fresh Issue; a subsequent valid operation remains usable
Non-canonical u-coordinates continue to follow RFC 7748 decoding, including the X25519 high-bit rule; the zero-secret check follows the optional admission check in RFC 7748 section 6
Acceptance
Six real native targets each pass 360 independent SHA3/SHAKE comparisons and 101 key-agreement cases, including full-width NIST private scalars in both directions, RFC vectors and 1,000 iterations, low-order rejection, non-canonical inputs and recovery
Both Delphi architectures also pass the 11 unchanged original ladder and recipient-envelope consumer methods; the compiler closures are audited against the current release composition
Run Tests/Linux/Run-CheckedCryptoAcceptance.py for normal checked console acceptance; Tests/Linux/CheckedCryptoAcceptance.en-us.md documents the compiler commands and independent vector generator
These checks establish the documented vector and rejection behaviour; they do not establish constant-time execution or a side-channel certification