proposal: crypto/cipher: Specify nonce and tag sizes for GCM

[defund]

Is there any reason for why NewGCM, NewGCMWithNonceSize, and NewGCMWithTagSize are public while newGCMWithNonceAndTagSize isn't? Unless I'm missing something, creating an AEAD with custom sizes for both nonce and tag seems impossible.

So the proposal would be to transform newGCMWithNonceAndTagSize -> NewGCMWithNonceAndTagSize.

[ALTree]

It appears that this was done on purpose. Look at 33f1768: it renamed NewGCMWithNonceAndTagSize to NewGCMWithTagSize and removed the nonceSize parameter.

Neither the commit message nor the issue it fixes (#24977) seem to give a rationale for the change, except for a small comment by @rsc on the issue, which says:

the name is a mouthful, and the nonce size may not be necessary to specify anyway.

Moreover, in #24171 (comment), rsc wrote:

The ability to change the nonce was a workaround for one special protocol, not a typical general need.

Overall, it seems that the limitation of not being able to set the nonce size is intentional.

cc @FiloSottile

[defund]

I guess it feels weird to offer two different options but not the composition of both, especially since they're only there for compatibility reasons. It would make sense if both helpers had a major use case for development, but they're meant to be used reluctantly.

[FiloSottile]

Is there any protocol that requires a custom tag and nonce size?

[rsc]

Adding to proposal minutes, seems headed for likely decline.

[rsc]

Based on the discussion above, this is a likely decline.

[rsc]

No change in consensus, so declined.