Unify the aes, aesni, aes-ctr, and aes-soft crates

[tarcieri]

Combines all four crates into a single aes crate.

The optional ctr feature exposes a consistent set of Aes*Ctr types.

cc @peterdettman

[tarcieri]

I was a bit torn on whether to call this a breaking change (i.e. bumping the version to 0.7.0-pre).

It seems like the only breaking case would be treating the types exported from aes as the same as either aesni or aes-soft, which would be breaking if ever AES-NI were/weren't used (depending on what you're expecting).

Given that, I think it's safe to call it backwards compatible. We could potentially release this as v0.6.1, and yank the previous v0.6.0 to prevent any shenanigans.

[newpavlov]

I thought that unification is worth only with added runtime detection. Otherwise AES-NI support will be hard to find for users who do not use the aes crate directly. In other words most users will use the software implementation, while with the current implementation they may notice aes-soft in their build log. I think I've seen projects which use aesni directly to motivate users to enable the aes target feature.

But I guess if we'll add the runtime detection before the next minor cipher version, merging crate now should not be a problem.

[tarcieri]

I thought that unification is worth only with added runtime detection.

We definitely need it for that. The current target-based gating of aesni vs aes-soft crate dependencies makes adding it impossible.

But also it's unclear how to add things like ARM acceleration (#10), which is especially important given the recent launch of the Apple M1. Would that otherwise go into aesni? But then we need to gate on two different targets, and things get quite complicated. Add yet another crate? I think as we add more hardware accelerated backends, converging on a single crate makes things a lot easier.

[newpavlov]

it's unclear how to add things like ARM acceleration

AFAIK the ideal solution is blocked on rust-lang/rfcs#2725. Meanwhile we would have to either write platform-specific code to extract available features, continue to rely on RUSTFLAGS, or add a feature for forcing hardware-accelerated implementation (assuming M1 uses the AArch64 crypto extension). Considering that ARM intrinsics are still unstable, I think the latter option will be fine for now.

[tarcieri]

Think I addressed all of the outstanding comments.

Re: cfg-if-based gating in lib.rs I mentioned earlier, I think I'd like to explore that as part of a separate PR.

An additional remaining question is still whether if this is merged, whether it could be published as v0.6.1, or if we should hold off and do a cipher crate upgrade and/or runtime detection first.

[newpavlov]

I think we can merge but do not publish just yet.