first commit

docs/security-stack/crypto/crypto-rsa/src/__fixtures__/rsa-2048-key.md

@@ -0,0 +1,42 @@
+# __fixtures__/rsa-2048-key
+
+## Purpose
+
+Real 2048-bit RSA keypair generated once at module-load time and exposed
+as canonical `RsaPublicKey` / `RsaPrivateKey` shapes for Stage 2+ tests
+(sign / verify / encrypt / decrypt). The 16-bit synthetic
+`TINY_PRIVATE_KEY` fixture in `test-keys.ts` cannot host a SHA-256 EM
+(32 bytes is wider than its 2-byte modulus), so signature tests need a
+real-sized key.
+
+## Features
+
+- Real 2048-bit keypair via `node:crypto.generateKeyPairSync`
+- Decoded into canonical bigint form via `finalisePrivateKey` /
+  `finalisePublicKey`
+- Stable within a single test run (deterministic across all tests in the
+  same process); not deterministic across processes
+- Re-run cost amortised across the entire Stage 2+ suite (≈ 50 ms once)
+
+## Usage
+
+```ts
+import {
+    RSA_2048_PRIVATE_KEY,
+    RSA_2048_PUBLIC_KEY,
+} from "../__fixtures__/rsa-2048-key.js";
+```
+
+## API Reference
+
+### `RSA_2048_PUBLIC_KEY: RsaPublicKey`
+
+### `RSA_2048_PRIVATE_KEY: RsaPrivateKey`
+
+## Implementation Notes
+
+- Tests that need byte-exact reference vectors must use one of the RFC
+  8017 Appendix C / Wycheproof / CAVP fixture files (added incrementally
+  ).
+- The fixture is not committed bytes-on-disk; regeneration on every
+  test process amortises down to noise once the rest of the suite runs.