Fix initial version of cardano-crypto-wallet

[lehins]

Description

This is a PR that fixes initial version of cardano-crypto-wallet that was added in #653 and reverts #666

Collection of issues that is fixed:

• integer overflows in multiple places

• interface that promoted leakage of EncryptedKey and no guarantees for finalization

• incorrect usage of crypto_aead_xchacha20poly1305_ietf_encrypt. Libsodium API specified:

  At most mlen + crypto_aead_xchacha20poly1305_ietf_ABYTES bytes are put into c, and the actual number of bytes is stored into clen ...

  while previous implementation assumed exact number of bytes, not at most

• Reduction in number of redundant arguments passed to C

• Remove redundant allocations

• Improve type safety of the implementation

• Ensure that the salt size is static at the type level and not customizable with KdfParams

• Drop duplicate values from the Envelope

• Expose all safe parts of the implementation as public API

• Reduce duplication in the test suite

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added if needed and existing tests are updated
• All visible changes are prepended to the latest section of a CHANGELOG.md for the affected packages.
  New section is never added with the code changes. (See RELEASING.md)
• When applicable, versions are updated in .cabal and CHANGELOG.md files according to the
  versioning process.
• The version bounds in .cabal files for all affected packages are updated.
  If you change the bounds in a cabal file, that package itself must have a version increase. (See RELEASING.md)
• Self-reviewed the diff

[lehins]

@perturbing and @disassembler, this PR is ready for review

[disassembler]

I integrated this and confirmed that I can migrate from pbkdf2-hmac-sha512 to argon2id-v2.

[perturbing]

A few remarks regarding names and testing.

Also, I think that there are 3 places where we do not properly clear private material in cardano-crypto-wallet/cbits/encrypted_sign.c

1. in add_left(); the zl8 buffer contains the scalar material but is never cleared
2. Similarly in add_left_public()
3. xchacha20poly1305_decrypt(): An edge case that should not happen, but if decrypt succeeds but plen != UNENCRYPTED_KEY_SIZE it will error without clearing secret_to_decrypt.

[lehins]

Fixed:

in add_left(); the zl8 buffer contains the scalar material but is never cleared

Fixed:

Similarly in add_left_public()

This one is not correct, since GHC's RTS will trigger libsodium functionality for memory clearing when mlsbCreate exits or when Haskell's type SecretKey gets GCed. Checkout how MLockedSizedBytes works in order to get an idea why this is the case. In other words secret_to_decrypt is guaranteed to be cleared.

xchacha20poly1305_decrypt(): An edge case that should not happen, but if decrypt succeeds but plen != UNENCRYPTED_KEY_SIZE it will error without clearing secret_to_decrypt.

[lehins]

@perturbing Addressed all comments

[perturbing]

Thanks, looks awesome!