auth: bind JWT verification to typed policy

.changes/typed-jwt-verifier.md

@@ -0,0 +1,8 @@
+---
+"rscrypto" = "minor"
+---
+
+RSA JWT/JWS verification is now bound to one verifier-owned
+`RsaJwtAlgorithm`. Peer-controlled `alg` metadata can only match that fixed
+policy; string-to-profile helpers and runtime algorithm-name signing and
+verification APIs have been removed.

docs/types.md

@@ -34,6 +34,8 @@ Prelude: `rscrypto::prelude` re-exports `Aead`, `Checksum`,
   other randomized APIs expose caller-supplied entropy where deterministic or constrained use needs it.
 - Bind RSA generic signing and verification through `RsaPrivateKey::signer(profile)` and
   `RsaPublicKey::verifier(profile)` so the padding and hash policy are explicit.
+- Bind JWT/JWS verification through `RsaPublicKey::jwt_verifier(algorithm)`. The verifier owns one typed
+  `RsaJwtAlgorithm`; peer-controlled `alg` metadata can match that policy but cannot select it.
 
 ## Checksums
 
@@ -139,6 +141,7 @@ Features: `signatures` / `key-exchange` or `ecdsa` / `ed25519` / `rsa` / `x25519
 | `Ed25519Keypair` | -- | RFC 8032 |
 | `RsaPublicKey`, `RsaPrivateKey`, `RsaPrivateKeyParts`, `RsaX509PublicKey`, `RsaPublicScratch`, `RsaPrivateScratch` | variable | RFC 8017 / RFC 4055 |
 | `RsaSignatureSigner`, `RsaSignatureVerifier` | profile-bound wrappers | RFC 8017 / RFC 4055 |
+| `RsaJwtAlgorithm`, `RsaJwtVerifier` | verifier-owned JWT/JWS policy | RFC 7515 / RFC 8725 |
 | `RsaSignatureProfile`, `RsaPssProfile`, `RsaPkcs1v15Profile`, `RsaOaepProfile`, `RsaPublicKeyPolicy`, `RsaKeyGenerationContract` | -- | RFC 8017 / RFC 4055 / FIPS 186-5 / protocol-specific profiles |
 | `RsaPublicExponent`, `RsaPublicExponentPolicy`, `RsaTlsSignatureSchemes`, `RsaX509PublicKeyAlgorithm` | -- | RSA policy / protocol mapping |
 | `X25519SecretKey` / `X25519PublicKey` / `X25519SharedSecret` | 32B each | RFC 7748 |
@@ -214,7 +217,7 @@ also has `seal_random_to_vec`.
 | `RsaPrivateOpError` | RSA private operation, padding, entropy, or fault-check failure | Reject input; do not expose reason to peer |
 | `RsaEncryptionError` | RSA public encryption shape, padding, or entropy failure | Fix input / entropy source |
 | `RsaKeyGenerationError` | RSA key generation policy or entropy failure | Adjust key size/policy or entropy source |
-| `RsaProtocolAlgorithmError` | Unsupported/confused JWT/COSE/TLS/X.509 RSA selector | Reject algorithm mapping |
+| `RsaProtocolAlgorithmError` | Unsupported/confused COSE/TLS/X.509 RSA selector | Reject algorithm mapping |
 | `AsconCxofCustomizationError` | Customization > 256 bytes | Shorten string |
 | `InvalidHexError` | Hex decode failure | Fix input |
 | `platform::OverrideError` | Override after detection init | Set before first call |

fuzz/target_impls/auth_rsa_protocol.rs

@@ -1,4 +1,4 @@
-use rscrypto::{RsaPublicKey, RsaSignatureProfile, RsaX509PublicKey};
+use rscrypto::{RsaJwtAlgorithm, RsaPublicKey, RsaSignatureProfile, RsaX509PublicKey};
 use rscrypto_fuzz::{FuzzInput, some_or_return, split_at_ratio};
 
 const RSA3072_SPKI: &[u8] = include_bytes!("../../benches/rsa_fixtures/rsa3072_spki.der");
@@ -99,7 +99,8 @@ pub fn run(data: &[u8]) {
   match mode % 14 {
     0 => {
       key
-        .verify_jwt_alg_with_scratch("PS256", MESSAGE_PSS, RSA3072_PSS_SHA256, &mut scratch)
+        .jwt_verifier(RsaJwtAlgorithm::Ps256)
+        .verify_with_scratch("PS256", MESSAGE_PSS, RSA3072_PSS_SHA256, &mut scratch)
         .expect("valid JWT PS256 fixture must verify");
     }
     1 => {
@@ -133,7 +134,9 @@ pub fn run(data: &[u8]) {
         .expect("valid TLS certificate rsa_pkcs1_sha256 fixture must verify");
     }
     5 => {
-      let _ = key.verify_jwt_alg_with_scratch(select(&JWT_ALGS, selector), message, signature, &mut scratch);
+      let _ = key
+        .jwt_verifier(RsaJwtAlgorithm::Ps256)
+        .verify_with_scratch(select(&JWT_ALGS, selector), message, signature, &mut scratch);
     }
     6 => {
       let _ = key.verify_cose_algorithm_id_with_scratch(
@@ -175,7 +178,6 @@ pub fn run(data: &[u8]) {
       let _ = RsaSignatureProfile::from_x509_signature_algorithm_der(message);
     }
     12 => {
-      let _ = RsaSignatureProfile::from_jwt_alg(select(&JWT_ALGS, selector));
       let _ = RsaSignatureProfile::from_cose_algorithm_id(*select(&COSE_ALGORITHMS, selector));
       let _ = RsaSignatureProfile::from_tls13_signature_scheme(u16::from_be_bytes([selector, split]));
       let _ = RsaSignatureProfile::from_tls_certificate_signature_scheme(u16::from_be_bytes([selector, split]));

src/auth/mod.rs

@@ -277,11 +277,11 @@ pub use pbkdf2::{diag_pbkdf2_sha256_verify_portable, diag_pbkdf2_sha512_verify_p
 pub use poly1305::{Poly1305, Poly1305OneTimeKey, Poly1305Tag};
 #[cfg(feature = "rsa")]
 pub use rsa::{
-  RsaEncryptionError, RsaKeyError, RsaKeyGenerationContract, RsaKeyGenerationError, RsaOaepProfile, RsaPkcs1v15Profile,
-  RsaPrivateKey, RsaPrivateKeyParts, RsaPrivateOpError, RsaPrivateScratch, RsaProtocolAlgorithmError, RsaPssProfile,
-  RsaPublicExponent, RsaPublicExponentPolicy, RsaPublicKey, RsaPublicKeyPolicy, RsaPublicOpError, RsaPublicScratch,
-  RsaSignatureProfile, RsaSignatureSigner, RsaSignatureVerifier, RsaTlsSignatureSchemes, RsaX509PublicKey,
-  RsaX509PublicKeyAlgorithm,
+  RsaEncryptionError, RsaJwtAlgorithm, RsaJwtVerifier, RsaKeyError, RsaKeyGenerationContract, RsaKeyGenerationError,
+  RsaOaepProfile, RsaPkcs1v15Profile, RsaPrivateKey, RsaPrivateKeyParts, RsaPrivateOpError, RsaPrivateScratch,
+  RsaProtocolAlgorithmError, RsaPssProfile, RsaPublicExponent, RsaPublicExponentPolicy, RsaPublicKey,
+  RsaPublicKeyPolicy, RsaPublicOpError, RsaPublicScratch, RsaSignatureProfile, RsaSignatureSigner,
+  RsaSignatureVerifier, RsaTlsSignatureSchemes, RsaX509PublicKey, RsaX509PublicKeyAlgorithm,
 };
 #[cfg(all(feature = "rsa", feature = "diag"))]
 pub use rsa::{