ogar-encryption: own the Argon2id KDF + envelope on argon2 0.6 (password-hashes fork)

[AdaWorldAPI]

What

ogar-encryption now implements the Argon2 part of the crypto suite itself instead of passing ndarray's through. kdf and envelope move out of the ndarray encryption re-export and into this crate. They run on argon2 0.6 from AdaWorldAPI/password-hashes, with the ndarray-simd feature. That feature runs Argon2's block compression on ndarray::simd::U64x8, selected at compile time, with no unsafe.

• kdf.rs and envelope.rs are ndarray master's modules with one changed import (encryption::aead instead of crate::aead), plus rustfmt. The public API is unchanged: kdf::*, envelope::*, and the root-level seal, open, KdfParams and EnvelopeError. Consumers need no edits; a2ui-rs uses KdfParams, kdf and aead, MedCare-rs uses seal, open, sign and hash.
• AEAD (XChaCha20-Poly1305), Ed25519 and SHA-384 are still re-exported from encryption.
• ogar-auth keeps its own argon2 pin, because password hashing is not encryption, and moves it to the same fork's 0.6. The 0.6 hash_password_with_salt takes the raw 16-byte salt from getrandom, so the SaltString step is gone.

Depends on

• argon2: vertical U64x8 compress over ndarray::simd (opt-in ndarray-simd feature) password-hashes#1 (the ndarray-simd backend). This PR pins that PR's branch until it merges.
• simd: U64x8::mul_lo32 — widening lo32×lo32→u64 on every backend (argon2 BlaMka) ndarray#331 merged; the fork's ndarray dependency now tracks master.

Verified

• ogar-encryption: 18 passed, 1 ignored. ogar-auth: 19 passed.
• clippy -D warnings clean on both crates; cargo fmt --check clean.
• cargo check -p ogar-encryption --target wasm32-unknown-unknown --features wasm passes with and without +simd128.
• cargo check --workspace --all-targets clean.
• There is exactly one ndarray in the dependency graph.

Not done here

• The wasm feature still forwards encryption's own browser bindings, which run on argon2 0.5.
• argon2 0.5.3 stays in the dependency tree until ndarray's encryption crate drops its kdf and envelope.

🤖 Generated with Claude Code

https://claude.ai/code/session_019HnekoM1EidTwQLS3oFVFm

---

Generated by Claude Code

---

Generated by Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 25b481ec-6ead-4f9b-8959-8954b5781d9d

📥 Commits

Reviewing files that changed from the base of the PR and between 2264f18 and 2344f84.

📒 Files selected for processing (6)

• crates/ogar-auth/Cargo.toml
• crates/ogar-auth/src/password.rs
• crates/ogar-encryption/Cargo.toml
• crates/ogar-encryption/src/envelope.rs
• crates/ogar-encryption/src/kdf.rs
• crates/ogar-encryption/src/lib.rs

 _____________________________________________________
< Merge conflicts fear my conflict-resolution skills. >
 -----------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9e894098-cd19-426a-9671-371f49d8d0ea)