AES key wrapping (AES-KW RFC 3394 / AES-KWP RFC 5649)

[WingZer0o]

Closes #95

Adds AES Key Wrap (AES-KW, RFC 3394 / NIST SP 800-38F KW) and AES Key Wrap with Padding (AES-KWP, RFC 5649 / KWP) so users can rotate the KEK protecting a data key by re-wrapping it instead of re-encrypting the data.

Implementation

• New CASAES128KeyWrap / CASAES256KeyWrap traits in symmetric::cas_symmetric_encryption, implemented by the new CASAES128KW / CASAES256KW structs in symmetric::aes_kw, following the existing two-file module pattern.
• Backed by the RustCrypto aes-kw crate (v0.2.1, matching the project's aes 0.8 stack), as suggested in the issue.
• Each struct exposes generate_kek, wrap_key / unwrap_key (unpadded KW) and wrap_key_with_padding / unwrap_key_with_padding (KWP).
• Input validation per NIST SP 800-38F, mapped to existing CasError variants (no ABI change): wrong KEK length → InvalidKey; KW key data below two semiblocks or not semiblock-aligned, empty KWP key data, or malformed wrapped-key lengths → InvalidInput; integrity-check/padding failures on unwrap → DecryptionFailed.
• 192-bit KEKs are intentionally not exposed, consistent with the rest of the library (AES-128/AES-256 only).

Tests (tests/aes_kw.rs, 14 tests)

• RFC 3394 §4 known-answer vectors: §4.1 (128-bit KEK), §4.3 and §4.6 (256-bit KEK), wrap and unwrap directions. (§4.2/§4.4/§4.5 use 192-bit KEKs and are skipped.)
• Wycheproof NIST-derived vector files checked into tests/data/aes/: aes_wrap_test.json (165 cases) and aes_kwp_test.json (254 cases). All 128/256-bit groups run: valid cases must wrap to the exact ciphertext and unwrap back; invalid cases must be rejected; acceptable cases (64-bit key data, below the SP 800-38F two-semiblock minimum) are rejected by our strict validation. The RFC 5649 worked examples both use a 192-bit KEK, so KWP known-answer coverage comes from these vectors.
• Round-trips for both KEK sizes, including KWP with unaligned (20-byte) and single-byte key data.
• The issue's use case: KEK rotation preserving the data key.
• Negative cases: invalid KEK/key-data/wrapped lengths, tampered ciphertext, wrong KEK.

Also adds an AES Key Wrapping section to docs/EXAMPLES.md and bumps the version to 0.2.89.

🤖 Generated with Claude Code