feat(password-hash): SEC-17768 Add v2 using Argon2id

[Sébastien Duquette (sduquette-devolutions)]

Introduce PasswordHashVersion::V2, which uses Argon2id as the hashing algorithm via DerivationParameters. A new hash_password_with_parameters function accepts pre-built DerivationParameters, enabling callers to supply either Argon2id or PBKDF2 settings. V2 is now the Latest version, and supporting helpers (Argon2::parameters, Pbkdf2::parameters, DerivationParameters::compute, DerivationParameters::output_length) are added to build and consume those parameters. The FFI and Python bindings are updated accordingly.

The iterations parameter has been removed from hash_password. Callers who previously passed a custom iteration count should use hash_password_with_parameters together with get_pbkdf2_derivation_parameters (Python) or GetPbkdf2DerivationParameters (FFI) to retain PBKDF2 with a custom iteration count. The default path now uses Argon2id with library defaults.

[Sébastien Duquette (sduquette-devolutions)]

Codex (@codex)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 87aeba9c00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[Copilot]

Pull request overview

Adds password hash V2 backed by Argon2id, makes it the latest/default password hashing format, and propagates the new parameter-based hashing API across Rust, FFI, Python, WASM, UniFFI, C#, CLI, and tests.

Changes:

• Adds PasswordHashVersion::V2, V2 serialization/deserialization, and hash_password_with_parameters.
• Adds helpers to build DerivationParameters for Argon2id and PBKDF2.
• Updates bindings, demos, docs, changelog, and tests for the removed iterations argument.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/password_hash/password_hash_v2.rs	Adds Argon2id-backed V2 password hash payload.
src/password_hash/mod.rs	Routes Latest/V2 to Argon2id and adds parameter-based hashing.
src/key_derivation/mod.rs	Adds parameter compute/output-length helpers.
src/key_derivation/key_derivation_v1.rs	Adds PBKDF2 derivation-parameter builder.
src/key_derivation/key_derivation_v2.rs	Adds Argon2 derivation-parameter builder.
src/enums.rs	Adds PasswordHashVersion::V2.
src/wasm.rs	Updates WASM password hash API and exposes parameter helpers.
ffi/src/lib.rs	Updates C ABI hashing entry points and adds parameter helper exports.
python/src/lib.rs	Updates Python hashing API and exposes parameter helper functions.
python/devolutions_crypto.pyi	Updates Python type stubs for the new API.
python/pyproject.toml	Bumps Python package version.
python/PYPI_README.md	Updates Python package documentation.
wrappers/python/tests/password_hash.py	Adds Python password hash tests.
wrappers/csharp/src/Managed.cs	Updates managed C# API and adds parameter-based hashing helpers.
wrappers/csharp/src/Native.Core.cs	Adds native C# interop declarations.
wrappers/csharp/src/Native.cs	Updates obsolete native wrapper signature.
wrappers/csharp/tests/unit-tests/TestManaged.cs	Adds C# parameter-based password hash test.
uniffi/devolutions-crypto-uniffi/src/lib.rs	Adds UniFFI V2 enum variant.
uniffi/devolutions-crypto-uniffi/src/password_hash.rs	Updates UniFFI password hash API.
uniffi/devolutions-crypto-uniffi/src/key_derivation.rs	Adds UniFFI derivation-parameter helpers.
wrappers/kotlin/lib/src/test/kotlin/org/devolutions/crypto/HashingTest.kt	Updates Kotlin tests for new signature.
wrappers/swift/DevolutionsCryptoSwift/Tests/DevolutionsCryptoSwiftTests/HashingTests.swift	Updates Swift tests for new signature.
wrappers/wasm/tests/tests/hashing.ts	Updates WASM hashing tests and adds params coverage.
wrappers/wasm/demo/src/app/service/encryption.inner.service.ts	Updates demo service wrapper for new hashing APIs.
wrappers/wasm/demo/src/app/password/password.component.ts	Adds algorithm selection and parameterized PBKDF2 path.
wrappers/wasm/demo/src/app/password/password.component.html	Adds algorithm dropdown and PBKDF2 iterations input.
wrappers/wasm/demo/src/app/inspect/inspect.component.ts	Teaches inspect UI to parse V2 password hashes.
tests/web.rs	Updates WASM web test for new hash signature.
tests/conformity.rs	Adds V2 conformity vector.
src/lib.rs	Updates crate-level password hash example.
README_RUST.md	Updates Rust password hash example.
cli/src/main.rs	Replaces CLI iterations option with serialized params option.
CHANGELOG.md	Documents breaking change and V2 addition.
fuzz/fuzz_targets/password_hash/hash_password.rs	Deletes obsolete hash-password fuzz target.
fuzz/fuzz_targets/password_hash/verify_password.rs	Deletes obsolete verify-password fuzz target.

Comments suppressed due to low confidence (2)

fuzz/fuzz_targets/password_hash/hash_password.rs:1

• Removing this fuzz target leaves a stale [[bin]] entry in fuzz/Cargo.toml (hash_password still points at this path), so the fuzz crate will fail to build. Please either remove the corresponding bin entry or keep/update the target for the new hash_password signature.
  fuzz/fuzz_targets/password_hash/verify_password.rs:1
• Removing this fuzz target leaves a stale [[bin]] entry in fuzz/Cargo.toml (verify_password still points at this path), so the fuzz crate will fail to build. Please either remove the corresponding bin entry or keep/update the target.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Mathieu Morrissette (mmorrissette-devolutions)]

LGTM