first commit

docs/security-stack/crypto/crypto-rsa/src/__fixtures__/test-keys.md

@@ -0,0 +1,40 @@
+# __fixtures__/test-keys
+
+## Purpose
+
+Tiny synthetic RSA keypair for unit tests that need an `RsaPrivateKey` /
+`RsaPublicKey` shape but don't need to run a real cryptographic
+operation. Modulus is 16 bits (`n = 251 * 241 = 60 491`) so the
+modulus-length policy gate's sub-1024-bit reject path can fire without
+colliding with real signing operations.
+
+## Features
+
+- Hand-computed CRT parameters (`d`, `p`, `q`, `dp`, `dq`, `qInv`)
+- Round-trip-safe through every parser/serialiser
+- 16-bit modulus exercises the `MODULUS_TOO_SHORT` rejection path
+
+## Usage
+
+```ts
+import {
+    TINY_PRIVATE_KEY,
+    TINY_PUBLIC_KEY,
+} from "../__fixtures__/test-keys.js";
+```
+
+## API Reference
+
+### `TINY_PUBLIC_KEY: RsaPublicKey`
+
+### `TINY_PRIVATE_KEY: RsaPrivateKey`
+
+## Implementation Notes
+
+- NOT a real cryptographic key. Do not use for any signature /
+  encryption operation that needs to interoperate with real RSA keys —
+  the modulus is far below the FIPS / industry minimum.
+- The 16-bit modulus is chosen specifically so it cannot host a SHA-256
+  encoded message (the EM is 32 bytes, the modulus is 2 bytes); this
+  triggers the canonical `MODULUS_TOO_SHORT` failure path without
+  needing to construct adversarial inputs.