[Sébastien Duquette (sduquette-devolutions)]

Add opt-in post-quantum public-key cryptography to the Rust core, based on
the X-Wing hybrid KEM (ML-KEM-768 + X25519). See SEC-15167.

• KeyVersion::V2: X-Wing key pairs (public key 1224 B, private key 40 B)
• CiphertextVersion::V3: KEM-DEM asymmetric ciphertext. The X-Wing shared
  secret is run through HKDF-SHA-256 with the label
  "devolutions_crypto ciphertext_v3", then used with XChaCha20-Poly1305.
• New key_encapsulation module: encapsulate / decapsulate producing an
  EncapsulatedKey (DataType::EncapsulatedKey = 10) and a SecretKey. HKDF
  label: "devolutions_crypto key_encapsulation_v1".
• Latest still selects the existing versions; PQ is opt-in.
• Decapsulation rejects non-contributory X25519 components; V2 public keys
  with a low-order X25519 half are rejected on parse.
• mix_key_exchange and online ciphertexts reject V2 keys.
• Conformity vectors and low-order tests added.

Breaking change (Rust API): the public From<&PublicKey> for
x25519_dalek::PublicKey and From<&PrivateKey> for StaticSecret impls are
removed in favour of crate-private fallible accessors.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[Copilot]

🔵 Needs a closer look

The security-critical hybrid-KEM integration and persistent wire formats require specialist security and interoperability review, plus dependency-backed native/Wasm validation unavailable in this snapshot.

No open issues 🎉

What changed in this PR

Adds opt-in post-quantum cryptography to the Rust core using X-Wing (ML-KEM-768 + X25519), while preserving existing Latest defaults.

Changes:

• Introduces V2 asymmetric keys, V3 asymmetric ciphertexts, and a versioned key-encapsulation API with separate HKDF labels.
• Rejects low-order X25519 components and incompatible key versions; replaces public X25519 conversions with crate-private fallible accessors.
• Adds conformity vectors, validation tests, dependencies, and binding enum updates.

File	Description
uniffi/​devolutions-crypto-uniffi/​src/​lib.rs	Mirrors new data-type and version variants.
tests/​low_order_points.rs	Tests rejection of low-order X-Wing components.
tests/​conformity.rs	Adds X-Wing key, ciphertext, and decapsulation vectors.
src/​utils.rs	Supports encapsulated-key header validation.
src/​online_ciphertext/​online_ciphertext_v1.rs	Uses fallible accessors to reject V2 keys.
src/​lib.rs	Exports and documents post-quantum functionality.
src/​key/​mod.rs	Integrates V2 keys, version checks, and tests.
src/​key/​key_v2.rs	Implements X-Wing keys and HKDF-derived secrets.
src/​key_encapsulation/​mod.rs	Adds the public encapsulation API, serialization, and tests.
src/​key_encapsulation/​key_encapsulation_v1.rs	Implements V1 encapsulated-key payloads and derivation.
src/​enums.rs	Defines new versions, data type, and subtype.
src/​ciphertext/​mod.rs	Integrates V3 ciphertext dispatch, parsing, and tests.
src/​ciphertext/​ciphertext_v3.rs	Implements X-Wing hybrid asymmetric encryption.
src/​ciphertext/​ciphertext_v2.rs	Extracts derived-key helpers and checks key compatibility.
CHANGELOG.md	Records new functionality and breaking Rust API changes.
Cargo.toml	Adds X-Wing and HKDF dependencies and declares Rust 1.85.
Cargo.lock	Locks new cryptographic dependencies and related updates.

_{Review effort: Balanced}