Handles variable-length nonce

[masihyeganeh]

I'm trying to fix#62, but I'm not sure I'm on the right track.
I read source code of other implementations of variable-length nonce GCM. They do it like this:

• if nonce is 12 bytes, copy the nonce in counter and add 1 to the last bit
• else copy GHASH of nonce to counter

I did that here. Maybe it's wrong. I'm not sure.
This will be a breaking change but as mentioned in here, it is time to introduce breaking changes.

[tarcieri]

This would require a change in the Aead trait. See RustCrypto/traits#65

[masihyeganeh]

Yeah. I did that too

[tarcieri]

Aah, apologies!

[tarcieri]

@masihyeganeh so there's another option which preserves type safety for all nonce sizes and avoids making changes to the underlying trait... that would be making the AES implementation generic around different nonce sizes much in the same way it's already generic around B::ParBlocks.

I think that's probably the best way to go in general, actually. If you'd like I can adapt your PR to do do that, as generic-array and typenum are a bit mindbending.

[masihyeganeh]

@tarcieri That would be great. let me know if I can help with that

[tarcieri]

I've open a PR based on this one which makes AesGcm generic around the nonce size: #126