Currently, additional authenticated data is passed in by the caller when encrypting, then stored alongside the encrypted message, and then returned to the caller when decrypting. This is not how it is commonly done in most other crypto libraries (e.g. https://docs.rs/ring/latest/ring/aead/struct.OpeningKey.html ); instead, the associated data is explicitly passed in when decrypting, since it usually comes from somewhere else entirely (e.g. a user id from an auth token, or a digest of some other piece of data known to the caller). In my experience, it is highly unusal for the additional data to be an actual self-contained byte string that needs to be stored alongside the ciphertext.

My suggestion is to:

1. change the Rust API to require the caller to pass in the additional data when decrypting
2. remove the associated_data field from the proto entirely (no need to shift proto field numbers around, we can just mark as reserved)

I don't believe anyone is actively using it anyways (but let me know if you know of any use case).

@ipetr0v @jul-sh @fernandolobato @conradgrobler WDYT?