initial commit

Signed-off-by: Kamal Tufekcic <kamal@lo.sh>

soliton/fuzz/fuzz_targets/fuzz_hybrid_verify.rs

@@ -0,0 +1,21 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use soliton::identity::{hybrid_verify, HybridSignature, IdentityPublicKey};
+
+fuzz_target!(|data: &[u8]| {
+    // pk (3200) + sig (3373) = 6573 minimum bytes.
+    if data.len() < 3200 + 3373 {
+        return;
+    }
+    let Ok(pk) = IdentityPublicKey::from_bytes(data[..3200].to_vec()) else {
+        return;
+    };
+    let Ok(sig) = HybridSignature::from_bytes(data[3200..3200 + 3373].to_vec()) else {
+        return;
+    };
+    let msg = &data[3200 + 3373..];
+
+    // hybrid_verify must never panic regardless of input.
+    // Exercises: Ed25519 verify + ML-DSA verify (pure-Rust ml-dsa crate).
+    let _ = hybrid_verify(&pk, msg, &sig);
+});