[SEC-16593] Increase default for PKBDF2 to 600,000 iterations

[Sébastien Duquette (sduquette-devolutions)]

Raise DEFAULT_PBKDF2_ITERATIONS to 600,000 to align with current OWASP recommendations for PBKDF2-HMAC-SHA256.

• Update the constant in src/lib.rs and propagate it to all callers
  (wasm, ffi, python, uniffi, cli) that previously hardcoded 10,000
• Update conformity test vector for derive_key_pbkdf2 default case
• Update all doc-comments and README examples to reflect the new value

[Copilot]

Pull request overview

This PR raises the default PBKDF2 iteration count to 600,000 (aligned with current OWASP guidance for PBKDF2-HMAC-SHA256) and updates wrapper defaults, conformity vectors, and documentation/examples across the repo.

Changes:

• Increase DEFAULT_PBKDF2_ITERATIONS to 600000 in the Rust core and propagate the new default across wrappers/CLI/FFI.
• Update conformity test vectors (Rust, WASM/TS, Python, Kotlin, C#) for the PBKDF2 default case.
• Refresh docs/examples and UI placeholders to reflect the new iteration count.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
wrappers/wasm/tests/tests/conformity.ts	Updates WASM conformity vector for PBKDF2 default case
wrappers/wasm/tests/README.md	Updates WASM test README header/content
wrappers/wasm/demo/src/app/utilities/utilities.component.html	Updates demo placeholder to 600000 iterations
wrappers/wasm/demo/src/app/password/password.component.html	Updates demo placeholder to 600000 iterations
wrappers/wasm/README.md	Updates WASM wrapper README and known-issues text
wrappers/python/tests/conformity.py	Updates Python conformity vector for PBKDF2 default case
wrappers/kotlin/lib/src/test/kotlin/org/devolutions/crypto/ConformityTest.kt	Updates Kotlin conformity vector for PBKDF2 default case
wrappers/csharp/tests/unit-tests/TestManaged.cs	Updates managed C# tests for decrypt-by-password paths
wrappers/csharp/tests/unit-tests/Conformity.cs	Updates C# conformity vector for PBKDF2 default case
wrappers/csharp/src/Native.cs	Updates obsolete API defaults to 600000 iterations
wrappers/csharp/src/Native.Core.cs	Adjusts P/Invoke signatures to allow nullable aad/salt arrays
wrappers/csharp/src/Managed.cs	Introduces C# DEFAULT_PBKDF2_ITERATIONS and updates defaults across public APIs
wrappers/csharp/README.md	Updates C# documentation examples to 600000 iterations
uniffi/devolutions-crypto-uniffi/src/utils.rs	Updates UniFFI default PBKDF2 iterations
uniffi/devolutions-crypto-uniffi/src/devolutions_crypto.udl	Updates UniFFI default hash_password iterations
tests/conformity.rs	Updates Rust conformity vector for PBKDF2 iteration change
src/wasm.rs	Uses core DEFAULT_PBKDF2_ITERATIONS for wasm-exposed defaults
src/utils.rs	Updates PBKDF2 documentation recommendation and example value
src/password_hash/mod.rs	Updates password-hash docs/examples to 600000 iterations
src/lib.rs	Updates crate docs and raises DEFAULT_PBKDF2_ITERATIONS to 600000
python/src/lib.rs	Updates PyO3 default signature values to 600000 iterations
python/devolutions_crypto.pyi	Updates Python stub defaults/docs/examples to 600000 iterations
python/PYPI_README.md	Updates PyPI README examples to 600000 iterations
ffi/src/lib.rs	Updates FFI docs to recommend 600000 iterations
ffi/devolutions-crypto.h	Updates C header docs to recommend 600000 iterations
cli/src/main.rs	Uses core DEFAULT_PBKDF2_ITERATIONS for CLI defaults
README_RUST.md	Updates Rust README example to 600000 iterations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mmorrissette-devolutions]

Codex (@codex) review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 233069493b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".

[mmorrissette-devolutions]

LGTM