Rust crypto core: FrodoKEM port, hybrid suite, Fury, STREAM, key files

FrodoKEM-640-SHAKE is ported from CIRCL v1.6.4 (the RustCrypto crate
implements the incompatible ISO variant) and reproduces the reference
NIST KAT digest. ML-KEM-768 comes from RustCrypto ml-kem. Derivation,
encapsulation, implicit rejection, KEK, header MAC, header parsing,
STREAM and Argon2id key files all match vectors from the Go oracle, Go's
files decrypt in Rust, and Go decrypts Rust's.

Co-Authored-By: Claude <noreply@anthropic.com>

oracle/go/internal/pqcrypt/oracle_decrypt_test.go

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Test-only: decrypts files another implementation wrote, for the Rust
+// port's interoperability tests. Skips unless VAULT_ORACLE_DECRYPT is set.
+
+package pqcrypt
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// TestOracleDecrypt opens every DIR/pattern-SIZE.fury with the identity of
+// master seed pattern(32, 1) and checks it holds pattern(SIZE, 0x5a), and
+// that every DIR/bad-*.fury is rejected.
+func TestOracleDecrypt(t *testing.T) {
+	dir := os.Getenv("VAULT_ORACLE_DECRYPT")
+	if dir == "" {
+		t.Skip("set VAULT_ORACLE_DECRYPT")
+	}
+	id, err := NewPQIdentityFromSeed(0x0001, pattern(32, 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	files, _ := filepath.Glob(filepath.Join(dir, "*.fury"))
+	if len(files) == 0 {
+		t.Fatal("no files")
+	}
+	for _, f := range files {
+		data, _ := os.ReadFile(f)
+		r, err := Decrypt(bytes.NewReader(data), id)
+		var got []byte
+		if err == nil {
+			got, err = io.ReadAll(r)
+		}
+		base := filepath.Base(f)
+		if strings.HasPrefix(base, "bad-") {
+			if err == nil {
+				t.Errorf("%s: accepted", base)
+			}
+			continue
+		}
+		size, _ := strconv.Atoi(strings.TrimSuffix(strings.TrimPrefix(base, "pattern-"), ".fury"))
+		if err != nil || !bytes.Equal(got, pattern(size, 0x5a)) {
+			t.Errorf("%s: %v", base, err)
+		}
+		t.Logf("%s ok", base)
+	}
+}