separate classical algorithms, remove dup code

.github/workflows/bedrock.yml

@@ -48,6 +48,24 @@ jobs:
           components: clippy
       - run: cargo clippy --all-features -- -D warnings
 
+  conventional-signature-features:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        feature:
+          - ecdsa-signatures
+          - ed25519-signatures
+          - rsa-signatures
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0 # master
+        with:
+          toolchain: stable
+          components: clippy
+      - run: cargo clippy --lib --no-default-features --features "${{ matrix.feature }}" -- -D warnings
+
   doc:
     runs-on: ubuntu-latest
     steps:

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Added
+
+- Added independent `ecdsa-signatures`, `ed25519-signatures`, and
+  `rsa-signatures` feature flags for conventional signature operations.
+
+### Changed
+
+- Replaced crate-local byte serialization wrappers with direct `serdect`
+  adapters and limited `hex` to test-only formatting and vector decoding.
+- Retained `classical-signatures` as a compatibility umbrella while allowing
+  downstream consumers to omit the RSA implementation affected by
+  RUSTSEC-2023-0071.
+
 ## v0.5.2 - 2026-09-01
 
 ### Added

Cargo.toml

@@ -12,13 +12,15 @@ name = "tectonic-bedrock"
 readme = "README.md"
 repository = "https://github.com/tectonic-labs/bedrock"
 rust-version = "1.95"
-version = "0.5.2"
+version = "0.5.3"
 
 [features]
 bird-of-prey = ["dep:curve25519-dalek", "falcon", "hmac", "ml-dsa", "sha2", "zeroize", "kgen", "sign", "vrfy"]
-classical-signatures = ["dep:ed25519-dalek", "dep:p256", "dep:p384", "dep:rsa", "dep:signature", "p256/ecdsa", "p256/pkcs8", "p384/ecdsa", "p384/pkcs8", "random", "rand_core_010", "sha2", "zeroize"]
+classical-signatures = ["ecdsa-signatures", "ed25519-signatures", "rsa-signatures"]
 decp = []
 default = ["eth_falcon", "falcon", "ml-dsa", "slh-dsa", "mayo", "decp", "encp", "kgen", "sign", "vrfy", "hhd"]
+ecdsa-signatures = ["dep:p256", "dep:p384", "dep:signature", "p256/ecdsa", "p256/pkcs8", "p384/ecdsa", "p384/pkcs8", "sha2", "zeroize"]
+ed25519-signatures = ["dep:ed25519-dalek", "dep:signature", "zeroize"]
 encp = []
 eth_falcon = ["falcon", "rand_chacha", "rand_core", "fn-dsa-comm/eth_falcon", "fn-dsa-sign?/eth_falcon", "fn-dsa-vrfy?/eth_falcon", "zeroize"]
 falcon = ["fn-dsa-comm"]
@@ -32,6 +34,7 @@ mceliece = ["dep:pq-mceliece", "rand_core_010", "getrandom_v04"]
 ml-dsa = ["dep:ml-dsa", "rand_core_010", "getrandom_v04"]
 ml-kem = ["dep:ml-kem"]
 random = ["getrandom_v04"]
+rsa-signatures = ["dep:rsa", "dep:signature", "random", "rand_core_010", "sha2", "zeroize"]
 sign = ["fn-dsa-comm", "fn-dsa-sign", "rand_core", "rand_core/getrandom"]
 slh-dsa = ["dep:slh-dsa", "rand_core_010", "getrandom_v04"]
 sntrup = ["dep:sntrup", "rand_core_010", "getrandom_v04"]
@@ -51,7 +54,6 @@ curve25519-dalek = { version = "5", default-features = false, features = ["alloc
 ed25519-dalek = { version = "3.0.0", default-features = false, features = ["alloc", "fast", "pkcs8", "signature", "zeroize"], optional = true }
 frodo-kem-rs = { version = "0.9", default-features = false, features = ["frodo"], optional = true }
 getrandom_v04 = { package = "getrandom", version = "0.4", features = ["sys_rng"], optional = true }
-hex = "0.4"
 hkdf = { version = "0.13.0", optional = true }
 hmac = { version = "0.13", features = ["zeroize"], optional = true }
 hqc-kem = { version = "=0.1.0-rc.0", default-features = false, features = ["alloc", "dcap", "ecap", "kgen"], optional = true }
@@ -118,7 +120,7 @@ version = "0.3.0"
 ciborium = "0.2.2"
 criterion = "0.8"
 falcon-rust = "0.1.3"
-hex = { version = "0.4", features = ["serde"] }
+hex = "0.4"
 postcard = { version = "1.0", default-features = false, features = ["use-std"] }
 rand = "0.10"
 rand_chacha = "0.10"

README.md

@@ -528,8 +528,16 @@ Control which algorithms and operations are enabled:
 - `mceliece` - Enable Classic McEliece key encapsulation
 - `frodo` - Enable FrodoKEM key encapsulation
 - `hqc` - Enable HQC key encapsulation and, with `hhd`, HQC HD derivation
-- `classical-signatures` - Enable transport-neutral RSA, P-256 ECDSA, P-384
-  ECDSA, and Ed25519 signing, verification, and private-key loading
+- `ecdsa-signatures` - Enable transport-neutral P-256 and P-384 ECDSA signing,
+  verification, and private-key loading
+- `ed25519-signatures` - Enable transport-neutral Ed25519 signing,
+  verification, and private-key loading
+- `rsa-signatures` - Enable transport-neutral RSA signing, verification, and
+  private-key loading. This feature is independently opt-in because the current
+  RustCrypto RSA implementation is affected by
+  [RUSTSEC-2023-0071](https://rustsec.org/advisories/RUSTSEC-2023-0071.html).
+- `classical-signatures` - Compatibility umbrella enabling `ecdsa-signatures`,
+  `ed25519-signatures`, and `rsa-signatures`
 - `key-agreement` - Enable ephemeral X25519, P-256, and P-384 key agreement
   (also enables `random`)
 - `sntrup` - Enable Streamlined NTRU Prime key encapsulation
@@ -594,7 +602,13 @@ tectonic-bedrock = { version = "0.5.2", default-features = false, features = ["k
 Conventional signature operations and private-key loading only:
 
 ```toml
-tectonic-bedrock = { version = "0.5.2", default-features = false, features = ["classical-signatures"] }
+tectonic-bedrock = { version = "0.5.3", default-features = false, features = ["classical-signatures"] }
+```
+
+RSA-free conventional signature operations:
+
+```toml
+tectonic-bedrock = { version = "0.5.3", default-features = false, features = ["ecdsa-signatures", "ed25519-signatures"] }
 ```
 
 ## Error Handling

src/bird_of_prey.rs

@@ -24,7 +24,7 @@
 use crate::det_rng::DetRng;
 use crate::error::{Error, Result};
 use crate::ml_dsa::{MlDsaScheme, MlDsaSignature, MlDsaSigningKey, MlDsaVerificationKey};
-use crate::{deserialize_hex_or_bin, os_rng, serialize_hex_or_bin};
+use crate::os_rng;
 use curve25519_dalek::EdwardsPoint;
 use curve25519_dalek::edwards::CompressedEdwardsY;
 use curve25519_dalek::scalar::Scalar;
@@ -128,8 +128,8 @@ serde_impl!(BirdOfPreyScheme);
 pub(crate) struct InnerBirdOfPrey {
     scheme: BirdOfPreyScheme,
     #[serde(
-        serialize_with = "serialize_hex_or_bin",
-        deserialize_with = "deserialize_hex_or_bin"
+        serialize_with = "serdect::slice::serialize_hex_lower_or_bin",
+        deserialize_with = "serdect::slice::deserialize_hex_or_bin_vec"
     )]
     value: Vec<u8>,
 }