skerkour commented :
The two principal reasons are what you mentioned:
- use in mobile/low end SBCs (like raspberry pi) which does not have
aes ni, Google also switched toXChaCha20-Poly1305for disk encryption (GitHub - google/adiantum: Adiantum and HPolyC specification and test vectors) - I feel really better using
XChaCha20-Poly1305rather than AES, because it’s a lot simpler to understand and it is a modern AEAD cipher: it supports both encryption and authentication, which allow detection of corrupted data (tink/PRIMITIVES.md at master · google/tink · GitHub)
Regarding the last point, I’m not sure if there is other mechanisms in place in badger, but AEAD encryption ‘gives for free’ the detection of corrupted data.
Regarding the breaking change, can’t it be added simply by an Options ? Like Options.EncryptionCipher and an Enum
const(
CipherXChaCha20Poly1305 = iota
AESCTR
}