Rust Crypto Version

This version of the draft is compatible with Rust Crypto's original balloon‑hash crate.