Use Argon2id for password KDF and add cascade, sealed-box, and PQ-hybrid primitives

[chadnpc]

Motivation

• Improve password-based key derivation security by replacing PBKDF2-SHA256 with Argon2id for ProtectData/UnprotectData.
• Provide stronger, modern composition modes: a paranoid AES→XChaCha20 cascade and a sealed-box authenticated asymmetric mode.
• Add a post-quantum hybrid encapsulation option combining classical ECDH with an ML-KEM for forward-looking encryption.
• Update documentation and README with usage examples for the new primitives.

Description

• Switched ProtectData/UnprotectData to use Argon2id (64 MiB, 3 iterations, parallelism 4) to derive 32-byte keys and preserved AES-256-GCM encryption and versioning.
• Added ProtectDataCascade and UnprotectDataCascade which derive a 64-byte master key via Argon2id, use the first 32 bytes for AES-256-GCM (inner) and the second 32 bytes for XChaCha20-Poly1305 (outer), and emit a versioned payload (0x02).
• Added CreateSealedBox for authenticated asymmetric payloads using P-256 ECDH (via Curve25519 wrapper), HKDF-SHA256, and XChaCha20-Poly1305 plus ProtectDataQuantumHybrid which combines ephemeral P-256 ECDH and an MLKem encapsulation, mixes secrets with BLAKE3, and returns ciphertext plus encapsulation metadata.
• Updated README.md and docs/CryptoBase.md with examples for ProtectDataCascade, CreateSealedBox, and ProtectDataQuantumHybrid and clarified algorithm parameters and payload formats.

Testing

• Ran the module test harness ./Test-Module.ps1 -skipBuildOutputTest and it completed successfully.
• Ran the full harness ./Test-Module.ps1 against ./BuildOutput/ and it completed successfully.

---

Codex Task

[coderabbitai]

Warning

Rate limit exceeded

@chadnpc has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 36 minutes and 5 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0eb98455-8b71-49a8-a8eb-0fd660eacd97

📥 Commits

Reviewing files that changed from the base of the PR and between f65020f and 27d5ef3.

📒 Files selected for processing (3)

• README.md
• cryptobase.psm1
• docs/CryptoBase.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/update-cryptobase-class-with-new-methods-1vezc6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 36 minutes and 5 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information