Support non-standard extra algorithms

[zonyitoo]

Background

Algorithms that are already supported by crypto2:

• aes-128-ccm, aes-256-ccm
• aes-128-gcm-siv, aes-256-gcm-siv
• aes-128-ocb-taglen128, aes-192-ocb-taglen128, aes-256-ocb-taglen128
• aes-siv-cmac-256, aes-siv-cmac-384, aes-siv-cmac-512

Algorithms that are the most wanted in other implementations:

• xchacha20-ietf-poly1305 (libsodium), like Request for restoring the deprecated AEAD cipher "XChaCha20-Poly1305-IETF" shadowsocks-android#2663

Some algorithms that are not implemented yet:

• sm4-gcm
• sm4-ccm

These algorithms are not standardized by shadowsocks' community, but it is still possible to enable these by optional features.

Proposal

Add an optional feature v1-aead-extra to enable all the extra algorithms described above.

Notice: xchacha20-ietf-poly1305 doesn't have a standardized specification about its technical detail, so we have to use its original and the only implementation in libsodium. This may significantly increase the output binary size.

[DuckSoft]

for xchacha20-ietf-poly1305 maybe we can file a feature request to crypto2.
embedding the whole libsodium is way too dirty.

[database64128]

Instead of adding rarely-used algorithms without changing the protocol, maybe we should turn our focus to implementing one of our proposed draft protocols.

[DuckSoft]

Instead of adding rarely-used algorithms without changing the protocol, maybe we should turn our focus to implementing one of our proposed draft protocols.

Agreed but that's offtopic here. Open another issue to track it.

[zonyitoo]

I don't think so. xchacha20-ietf-poly1305 has 2 different definitions, the only implementation in libsodium has a 64-bit counter but the RFC doesn't define it clearly. But according to this thread, RFC seems to imply it has a 32-bit counter.

So it the safest way is to use the libsodium's implementation.