Add support for symmetric cryptography with Sequoia

[ghost]

As of now, we depend on GPG for asymmetric cryptography. However, depending on GPGME seems to be an issue if Windows support is desired.

An alternative seems to be Sequoia, which has Windows support on their roadmap for 2019. To get started, it should already be possible to add symmetric (i.e. password based) cryptography to sheesy, serving as quick-start alternative to the key-based cryptography and thus somewhat competing with keypass and its command-line tools.

Requirements

• assure symmetric crypto is compatible with GPG, and ideally the GPG tools can be used for decryption, too, if the password is known.

Open Questions

• should it be possible to transition between stores of different kinds, e.g. asymmetric to symmetric and vice-versa?
• Will it be clear how files are encrypted, to not mistake asymmetrically encrypted files with symmetric ones and fail decryption for that reason.

Alternatives

• https://github.com/miscreant/miscreant-rs
  • asymmetric pure-rust crypto. Would work as well, but may be less vetted than nettle.

Related to #12 .

[nwalfield]

* assure symmetric crypto is compatible with GPG, and ideally the GPG tools can be used for decryption, too, if the password is known.

In this regard, Sequoia should be fully compatible with GnuPG, since they are both implementing OpenPGP. If there are any incompatibilities, then they would be a high-priority issue for Sequoia.

* should it be possible to transition between stores of different kinds, e.g. asymmetric to symmetric and vice-versa?

Using OpenPGP, it is possible to encrypt to multiple pubic keys and multiple passwords. And, it is possible to do both at the same time. Reencrypting is conceptually straightforward: just decrypt the session key, and reencrypt it to a password or public key. I've added an issue to Sequoia's issue tracker to make sure this is convenient:

https://gitlab.com/sequoia-pgp/sequoia/issues/118

* Will it be clear how files are encrypted, to not mistake asymmetrically encrypted files with symmetric ones and fail decryption for that reason.

I'm not sure if you need to do anything here. But if you do, inspecting a message (without decrypting it) is straightforward.

Alternatives

* https://github.com/miscreant/miscreant-rs
  
  * asymmetric pure-rust crypto. Would work as well, but may be less vetted than `nettle`.

This is an interesting alternative, but it has the disadvantage that it doesn't use the OpenPGP format, and thus is incompatible with GnuPG.

[ghost]

@nwalfield You won't believe how much your input here is valued, just because I have no idea of what I am doing when implementing anything with cryptography. Sequoia is made for me, hopefully exposing a safe and hard-to-misuse interface to common operations.
I also get the feeling that if I start interacting with Sequoia, I would not be on my own, which does indeed calm my mind given that I go a little out of my comfort zone. So far, GPGME was kind to me, reducing the surface to just a few functions, that don't need more than the basic knowledge.

On the flip-side, I might be a good use-case for you in terms of usability - if I can use it, probably others can do to :D!

[nwalfield]

One of our primary goals for Sequoia is to provide a convenient, easy-to-use API. So, we're happy to get your feedback and understand your issues. But, we're not just interested in using you to critique our API, another goal is to support our users by providing our expertise to make sure that not just something uses Sequoia/OpenPGP, but does something great with them! :)