`aead`: Add `CustomizedInit` trait

[makavity]

In digest v0.11 have added CustomizedInit trait, which is helpful to implement cshake and bash-prg-hash.

That trait would be helpful in aead to implement bash-prg-ae, authenticated encryption from Belarus Rebublic specification.

@newpavlov

[newpavlov]

I guess we could move the trait to crypto-common, but IMO it's fairly weird to have "customization" for an AEAD mode.

I think that "announcement" in the bash-prg-ae spec plays role of nonce. Note that the encryption function accepts "announcement", plaintext, associated data, and key.

[makavity]

I'll check it out in more detail and let you know. Thanks for the tip.

[makavity]

5.9: Announce can contain nonce
Maybe it would be better to use A || Nonce as Nonce?

[newpavlov]

Maybe it would be better to use A || Nonce as Nonce?

Since it's not explicitly specified in the spec, I would prefer to not make a judgement here.

I think the easiest way will be to just use the existing nonce API and add a note based on sections 5.8 and 5.9 to the crate docs.

[newpavlov]

One problem with the existing aead API is that it assumes fixed size nonces, while bash-prg-ae supports variable size announcements (and even empty ones). We could paper over it by introducing a generic parameter for nonce sizes like we do in aes-gcm, but it may be something worth to consider as part of the next aead release.

cc @tarcieri