crypto: deprecated crypto algorithms and replaced with better alternatives

New ciphers are using authenticated encryption with associated data
(AEAD) and per-content key derived using HMAC-SHA256:

* AES256-GCM-HMAC-SHA256
* CHACHA20-POLY1305-HMAC-SHA256

They support content IDs of arbitrary length and are quite fast:

On my 2019 MBP:

- BLAKE2B-256 + AES256-GCM-HMAC-SHA256 - 648.7 MiB / second
- BLAKE2B-256 + CHACHA20-POLY1305-HMAC-SHA256 - 597.1 MiB / second
- HMAC-SHA256 + AES256-GCM-HMAC-SHA256 351 MiB / second
- HMAC-SHA256 + CHACHA20-POLY1305-HMAC-SHA256 316.2 MiB / second

Previous ciphers had several subtle issues:

* SALSA20 encryption, used weak nonce (64 bit prefix of content ID),
  which means that for any two contents, whose IDs that have the same
  64-bit prefix, their plaintext can be decoded from the ciphertext
  alone.

* AES-{128,192,256}-CTR were not authenticated, so we were
  required to hash plaintext after decryption to validate. This is not
  recommended due to possibility of subtle timing attacks if an attacker
  controls the ciphertext.

* SALSA20-HMAC was only validating checksum and not that the ciphertext
  was for the correct content ID.

New repositories cannot be created using deprecated ciphers, but they
will still be supported for existing repositories, until at least 0.6.0.

The users are encouraged to migrate to one of new ciphers when 0.5.0 is
out.

cli/command_benchmark_crypto.go

@@ -13,10 +13,11 @@ import (
 )
 
 var (
-	benchmarkCryptoCommand    = benchmarkCommands.Command("crypto", "Run hash and encryption benchmarks")
-	benchmarkCryptoBlockSize  = benchmarkCryptoCommand.Flag("block-size", "Size of a block to encrypt").Default("1MB").Bytes()
-	benchmarkCryptoEncryption = benchmarkCryptoCommand.Flag("encryption", "Test encrypted formats").Default("true").Bool()
-	benchmarkCryptoRepeat     = benchmarkCryptoCommand.Flag("repeat", "Number of repetitions").Default("100").Int()
+	benchmarkCryptoCommand              = benchmarkCommands.Command("crypto", "Run hash and encryption benchmarks")
+	benchmarkCryptoBlockSize            = benchmarkCryptoCommand.Flag("block-size", "Size of a block to encrypt").Default("1MB").Bytes()
+	benchmarkCryptoEncryption           = benchmarkCryptoCommand.Flag("encryption", "Test encrypted formats").Default("true").Bool()
+	benchmarkCryptoRepeat               = benchmarkCryptoCommand.Flag("repeat", "Number of repetitions").Default("100").Int()
+	benchmarkCryptoDeprecatedAlgorithms = benchmarkCryptoCommand.Flag("deprecated", "Include deprecated algorithms").Bool()
 )
 
 func runBenchmarkCryptoAction(ctx *kingpin.ParseContext) error {
@@ -31,7 +32,7 @@ func runBenchmarkCryptoAction(ctx *kingpin.ParseContext) error {
 	data := make([]byte, *benchmarkCryptoBlockSize)
 
 	for _, ha := range hashing.SupportedAlgorithms() {
-		for _, ea := range encryption.SupportedAlgorithms() {
+		for _, ea := range encryption.SupportedAlgorithms(*benchmarkCryptoDeprecatedAlgorithms) {
 			isEncrypted := ea != encryption.NoneAlgorithm
 			if *benchmarkCryptoEncryption != isEncrypted {
 				continue

cli/command_repository_create.go

@@ -18,8 +18,8 @@ import (
 var (
 	createCommand = repositoryCommands.Command("create", "Create new repository in a specified location.")
 
-	createBlockHashFormat       = createCommand.Flag("block-hash", "Block hash algorithm.").PlaceHolder("ALGO").Default(hashing.DefaultAlgorithm).Enum(hashing.SupportedAlgorithms()...)
-	createBlockEncryptionFormat = createCommand.Flag("encryption", "Block encryption algorithm.").PlaceHolder("ALGO").Default(encryption.DefaultAlgorithm).Enum(encryption.SupportedAlgorithms()...)
+	createBlockHashFormat       = createCommand.Flag("block-hash", "Content hash algorithm.").PlaceHolder("ALGO").Default(hashing.DefaultAlgorithm).Enum(hashing.SupportedAlgorithms()...)
+	createBlockEncryptionFormat = createCommand.Flag("encryption", "Content encryption algorithm.").PlaceHolder("ALGO").Default(encryption.DefaultAlgorithm).Enum(encryption.SupportedAlgorithms(false)...)
 	createSplitter              = createCommand.Flag("object-splitter", "The splitter to use for new objects in the repository").Default(splitter.DefaultAlgorithm).Enum(splitter.SupportedAlgorithms()...)
 
 	createOnly = createCommand.Flag("create-only", "Create repository, but don't connect to it.").Short('c').Bool()