Expose remaining cas-lib 0.2.85 APIs through the FFI layer

[WingZer0o]

Gap analysis of cas-lib 0.2.85's public API vs what this SDK currently exposes (as of the ChaCha20-Poly1305 addition on the Wycheproof branch, PR #89).

Whole algorithms not exposed

cas-lib module	Functions	Notes
AES-GCM-SIV (128 & 256) — symmetric/aes_gcm_siv.rs	generate_key, generate_nonce, encrypt_plaintext, decrypt_ciphertext, key_from_x25519_shared_secret, key_from_vec	Nonce-misuse-resistant AEAD. Wycheproof has aes_gcm_siv_test.json, so it can be validated the same way ChaCha20-Poly1305 was
ML-KEM-1024 — pqc/ml_kem.rs	ml_kem_1024_generate, ml_kem_1024_encapsulate, ml_kem_1024_decapsulate	Post-quantum KEM (FIPS 203). Wycheproof mlkem_1024_test.json covers the deterministic decapsulation path
SLH-DSA — pqc/slh_dsa.rs	generate_signing_and_verification_key, sign_message, verify_signature	Post-quantum signatures (FIPS 205). No Wycheproof vectors exist yet
PBKDF2 — password_hashers/pbkdf2.rs	derivation(password, iterations), derivation_with_salt(password, iterations, salt)	Wycheproof has pbkdf2_hmacsha*_test.json; testable via the _with_salt variant if hash/output parameters line up

Individual methods missing from already-exposed domains

Domain	Missing function	What it does
Argon2	derive_aes_128_key, derive_aes_256_key	Derive an AES key directly from a password — pairs with the existing AES wrappers
AES-GCM 128/256	key_from_vec	Validates/normalizes a caller-supplied key (the SIV variants have it too)
Ed25519	ed25519_verify_with_key_pair	Verify using the full keypair; only the public-key verify variant is exposed today

Fully exposed already (no action)

AES-GCM, ChaCha20-Poly1305, X25519, HMAC-SHA256, HPKE, Ascon-AEAD128, SHA/BLAKE2 hashers, bcrypt/scrypt/argon2 hashing+verification, zstd.

Suggested order

1. AES-GCM-SIV — complete algorithm, Wycheproof vectors ready, same recipe as the ChaCha20-Poly1305 exposure
2. ML-KEM-1024 — first post-quantum primitive, decapsulation is Wycheproof-testable
3. PBKDF2 + Argon2 key derivation helpers
4. SLH-DSA and the small per-domain gaps

Each addition follows the standard four-step recipe in CLAUDE.md: #[napi] fn in src/<domain>/, npm run build:rust, TS wrapper class in src-ts/<domain>/, barrel exports.

🤖 Generated with Claude Code

[WingZer0o]

Implementation is complete on the Wycheproof branch (pending commit/PR) with a few adjustments discovered during the work:

• Exposed: AES-GCM-SIV (128/256, with Wycheproof vectors), ML-KEM-1024 (with the 9 semi-expanded decaps Wycheproof vectors + round-trips), SLH-DSA SHAKE-128f (round-trips; no Wycheproof vectors exist), PBKDF2 (round-trips), key_from_vec for AES-GCM and AES-GCM-SIV, and verifyEd25519WithKeyPair.
• Not exposed — Argon2 derive_aes_128/256_key: cas-lib generates a random salt it never returns, so derived keys are unreproducible. Deferred until Findings from exposing cas-lib 0.2.85 in the TypeScript SDK: Argon2 key derivation, ML-KEM dk validation, PBKDF2 doc cas-lib#90 is resolved.
• PBKDF2 correction: cas-lib's PBKDF2 is HMAC-SHA3-256 (the doc comment says SHA-256), so Wycheproof's pbkdf2_hmacsha* vectors don't apply after all.
• ML-KEM finding: Wycheproof's two InvalidDecapsulationKey vectors are accepted instead of rejected (missing FIPS 203 §7.3 dk hash check in RustCrypto ml-kem) — documented as a known deviation in the test suite and reported in Findings from exposing cas-lib 0.2.85 in the TypeScript SDK: Argon2 key derivation, ML-KEM dk validation, PBKDF2 doc cas-lib#90.

🤖 Generated with Claude Code