Checked crypto arithmetic and key agreement
Version 2.955.1 preserves the existing SHA3, SHAKE and key-agreement APIs with integer overflow and range checks enabled in Delphi and Free Pascal
SHA3-256, SHA3-384, SHA3-512 and SHAKE256 retain their existing outputs across empty inputs, rate boundaries, multiple blocks, streamed updates and repeated SHAKE extraction
P-256, P-384 and P-521 exchanges use explicit low-word operations wherever the field implementation intentionally works modulo 2^64; high-bit constants and Montgomery operations remain usable in checked 32-bit builds
Montgomery shared-secret admission
HPDFX25519 and HPDFX448 check the complete canonical output bytes and raise EInvalidOpException when the shared secret is all zero, including weak field representations whose internal limbs are nonzero
HPDFComputeKeyAgreementSecret translates this rejection into False, an empty SharedSecret and a fresh Issue; a subsequent valid operation remains usable
Noncanonical u-coordinates continue to follow RFC 7748 decoding, including the X25519 high-bit rule; the zero-secret check follows the optional admission check in RFC 7748 section 6
Acceptance
Six actual native targets each pass 360 independent SHA3/SHAKE comparisons and 101 key-agreement cases, including full-width NIST private scalars in both directions, RFC vectors and 1,000 iterations, low-order rejection, noncanonical inputs and recovery
Both Delphi architectures also pass the 11 unchanged original ladder and recipient-envelope consumer methods; the actual compiler closures are audited against the current release composition
Run Tests/Linux/Run-CheckedCryptoAcceptance.py for normal checked console acceptance; Tests/Linux/CheckedCryptoAcceptance.en-us.md describes the compiler commands and independent vector generator
These checks establish the documented vector and rejection behavior; they do not establish constant-time execution or a side-channel certification