aes: split encryptors and decryptors

[newpavlov]

cipher v0.3 introduces separate trait for encryption and decryption. Preliminary migration was done in #202, but AES types have not been split into encryptors and decryptors yet.

[tarcieri]

This ended up being less helpful for the aes(-soft) crate than before after #185, which allowed using the same fixsliced round keys. So it could benefit AES-NI, but doesn't really help with the fixsliced implementation.

I still like the BlockEncrypt/BlockDecrypt split in general though: it helped clean up the Mut-equivalent traits, and also means someone implementing e.g. an AES peripheral who only cares about CTR mode (or various other modes like CFB) to only implement the encryption operation.

[newpavlov]

I wonder what should we do... The split would not only make AES-NI types smaller, but also will improve performance of cipher initialization a bit as well. Maybe fixslicing decryption can benefit from having separate decryption keys as well? I guess we could expose all 3 types for each cipher (encryptor, decryptor, and universal), it will involve a certain amount of boilerplate, but should be doable.

[tarcieri]

Yeah, I agree it'd benefit AES-NI.

I'd suggest trying to do a release of everything we have now, then exploring this as part of an additive non-breaking changes after an initial breaking release.

Perhaps with the help of macros it won't be too much of a pain.

[tarcieri]

Note that in the ARMv8 backend, I've gone ahead and split up encryptors/decryptors: #250

I think it actually improves the code quality, for example I have impl From<Aes128Enc> for Aes128Dec to compute the inverse key schedule, and a impl NewBlockCipher for Aes128Dec implemented in terms of the from transformation.