openpgp: Fix Encryptor's lifetime parameter.

  - `Encryptor` uses a single lifetime for two fields, which is too
    restrictive in some situations.

  - To avoid breaking the API, introduce `Encryptor2`, which is just
    `Encryptor` renamed, and with an added lifetime parameter, and make
    `Encryptor` a thin wrapper around `Encryptor2`.

  - Deprecate `Encryptor`.

  - See #1028.

9 files changed, 277 insertions, 66 deletions

diff --git a/autocrypt/src/lib.rs b/autocrypt/src/lib.rs
index d75649da..b76c4208 100644
--- a/autocrypt/src/lib.rs
+++ b/autocrypt/src/lib.rs
@@ -37,7 +37,7 @@ use openpgp::parse::{
 };
 use openpgp::serialize::Serialize;
 use openpgp::serialize::stream::{
-    Message, LiteralWriter, Encryptor,
+    Message, LiteralWriter, Encryptor2,
 };
 use openpgp::crypto::Password;
 use openpgp::policy::Policy;
@@ -526,7 +526,7 @@ impl AutocryptSetupMessage {
         {
             // Passphrase-Format header with value numeric9x4
             let m = Message::new(&mut armor_writer);
-            let m = Encryptor::with_passwords(
+            let m = Encryptor2::with_passwords(
                 m, vec![self.passcode.clone().unwrap()]).build()?;
 
             let m = LiteralWriter::new(m).build()?;
diff --git a/ipc/tests/gpg-agent.rs b/ipc/tests/gpg-agent.rs
index bc875641..8ec4482d 100644
--- a/ipc/tests/gpg-agent.rs
+++ b/ipc/tests/gpg-agent.rs
@@ -298,7 +298,7 @@ fn decrypt(also_try_explicit_async: bool) -> openpgp::Result<()> {
 
             // We want to encrypt a literal data packet.
             let encryptor =
-                Encryptor::for_recipients(message, recipients)
+                Encryptor2::for_recipients(message, recipients)
                 .build().unwrap();
 
             // Emit a literal data packet.
diff --git a/openpgp/NEWS b/openpgp/NEWS
index 3d9d5163..e41158a5 100644
--- a/openpgp/NEWS
+++ b/openpgp/NEWS
@@ -32,6 +32,10 @@
      adds a primary key binding signature.
 
    - The MSRV is now 1.67.
+
+   - serialize::stream::Encryptor2 replaces
+     serialize::stream::Encryptor, which fixes an issue with the
+     lifetimes.
 ** New functionality
    - The RustCrypto backend now supports DSA.
    - crypto::SessionKey::as_protected
@@ -41,6 +45,7 @@
    - parse::PacketParser::start_hashing
    - parse::PacketParserBuilder::automatic_hashing
    - impl Default for types::AEADAlgorithm
+   - serialize::stream::Encryptor2
    - types::AEADAlgorithm::GCM
    - types::Bitfield
    - types::Features::clear_seipdv1
@@ -56,6 +61,7 @@
    - packet::signature::subpacket::SubpacketAreas::preferred_aead_algorithms
    - packet::signature::subpacket::SubpacketTag::PreferredAEADAlgorithms
    - packet::signature::subpacket::SubpacketValue::PreferredAEADAlgorithms
+   - serialize::stream::Encryptor
    - types::Curve::len, use types::Curve::bits instead
    - types::Features::clear_mdc
    - types::Features::set_mdc
diff --git a/openpgp/benches/common/encrypt.rs b/openpgp/benches/common/encrypt.rs
index 7838170a..00641363 100644
--- a/openpgp/benches/common/encrypt.rs
+++ b/openpgp/benches/common/encrypt.rs
@@ -2,7 +2,7 @@ use sequoia_openpgp as openpgp;
 use openpgp::cert::Cert;
 use openpgp::policy::StandardPolicy;
 use openpgp::serialize::stream::{
-    Armorer, Encryptor, LiteralWriter, Message, Signer,
+    Armorer, Encryptor2, LiteralWriter, Message, Signer,
 };
 
 use std::io::Write;
@@ -14,7 +14,7 @@ pub fn encrypt_with_password(
 ) -> openpgp::Result<Vec<u8>> {
     let mut sink = vec![];
     let message =
-        Encryptor::with_passwords(Message::new(&mut sink), Some(password))
+        Encryptor2::with_passwords(Message::new(&mut sink), Some(password))
             .build()?;
     let mut w = LiteralWriter::new(message).build()?;
     w.write_all(bytes)?;
@@ -37,7 +37,7 @@ pub fn encrypt_to_cert(
         .for_transport_encryption()
         .for_storage_encryption();
     let message =
-        Encryptor::for_recipients(Message::new(&mut sink), recipients)
+        Encryptor2::for_recipients(Message::new(&mut sink), recipients)
             .build()?;
     let mut w = LiteralWriter::new(message).build()?;
     w.write_all(bytes)?;
@@ -99,7 +99,7 @@ pub fn encrypt_to_cert_and_sign(
 
     let message = Message::new(&mut sink);
     let message = Armorer::new(message).build()?;
-    let message = Encryptor::for_recipients(message, recipients).build()?;
+    let message = Encryptor2::for_recipients(message, recipients).build()?;
     let message = Signer::new(message, signing_keypair)
         //.add_intended_recipient(&recipient)
         .build()?;
diff --git a/openpgp/examples/encrypt-for.rs b/openpgp/examples/encrypt-for.rs
index 0b0bc998..04c8506e 100644
--- a/openpgp/examples/encrypt-for.rs
+++ b/openpgp/examples/encrypt-for.rs
@@ -12,7 +12,7 @@ use crate::openpgp::serialize::stream::Armorer;
 use crate::openpgp::types::KeyFlags;
 use crate::openpgp::parse::Parse;
 use crate::openpgp::serialize::stream::{
-    Message, LiteralWriter, Encryptor,
+    Message, LiteralWriter, Encryptor2,
 };
 use crate::openpgp::policy::StandardPolicy as P;
 
@@ -69,7 +69,7 @@ fn main() -> openpgp::Result<()> {
     let message = Armorer::new(message).build()?;
 
     // We want to encrypt a literal data packet.
-    let message = Encryptor::for_recipients(message, recipients)
+    let message = Encryptor2::for_recipients(message, recipients)
         .build().context("Failed to create encryptor")?;
 
     let mut message = LiteralWriter::new(message).build()
diff --git a/openpgp/examples/generate-encrypt-decrypt.rs b/openpgp/examples/generate-encrypt-decrypt.rs
index bd8e1dfa..2e6c6b12 100644
--- a/openpgp/examples/generate-encrypt-decrypt.rs
+++ b/openpgp/examples/generate-encrypt-decrypt.rs
@@ -58,7 +58,7 @@ fn encrypt(p: &dyn Policy, sink: &mut (dyn Write + Send + Sync),
     let message = Message::new(sink);
 
     // We want to encrypt a literal data packet.
-    let message = Encryptor::for_recipients(message, recipients)
+    let message = Encryptor2::for_recipients(message, recipients)
         .build()?;
 
     // Emit a literal data packet.
diff --git a/openpgp/examples/pad.rs b/openpgp/examples/pad.rs
index 2dfc23f4..5bcfa29f 100644
--- a/openpgp/examples/pad.rs
+++ b/openpgp/examples/pad.rs
@@ -11,7 +11,7 @@ use sequoia_openpgp as openpgp;
 use crate::openpgp::types::KeyFlags;
 use crate::openpgp::parse::Parse;
 use crate::openpgp::serialize::stream::{
-    Armorer, Message, LiteralWriter, Encryptor, padding::*,
+    Armorer, Message, LiteralWriter, Encryptor2, padding::*,
 };
 use crate::openpgp::policy::StandardPolicy as P;
 
@@ -66,7 +66,7 @@ fn main() -> openpgp::Result<()> {
     let message = Armorer::new(message).build()?;
 
     // We want to encrypt a literal data packet.
-    let message = Encryptor::for_recipients(message, recipients)
+    let message = Encryptor2::for_recipients(message, recipients)
         .build().context("Failed to create encryptor")?;
 
     let message = Padder::new(message)
diff --git a/openpgp/examples/reply-encrypted.rs b/openpgp/examples/reply-encrypted.rs
index b0d521c5..61d41d11 100644
--- a/openpgp/examples/reply-encrypted.rs
+++ b/openpgp/examples/reply-encrypted.rs
@@ -105,7 +105,7 @@ pub fn main() -> openpgp::Result<()> {
     }
 
     // We want to encrypt a literal data packet.
-    let message = Encryptor::with_session_key(message, algo, sk)?
+    let message = Encryptor2::with_session_key(message, algo, sk)?
         .build().context("Failed to create encryptor")?;
 
     let mut message = LiteralWriter::new(message).build()
diff --git a/openpgp/src/serialize/stream.rs b/openpgp/src/serialize/stream.rs
index d3e69f3e..c0b64f0a 100644
--- a/openpgp/src/serialize/stream.rs
+++ b/openpgp/src/serialize/stream.rs
@@ -15,7 +15,7 @@
 //! be freely combined:
 //!
 //!   - [`Armorer`] applies ASCII-Armor to the stream,
-//!   - [`Encryptor`] encrypts data fed into it,
+//!   - [`Encryptor2`] encrypts data fed into it,
 //!   - [`Compressor`] compresses data,
 //!   - [`Padder`] pads data,
 //!   - [`Signer`] signs data,
@@ -77,7 +77,7 @@
 //! use openpgp::policy::StandardPolicy;
 //! use openpgp::cert::prelude::*;
 //! use openpgp::serialize::stream::{
-//!     Message, Armorer, Encryptor, Signer, LiteralWriter,
+//!     Message, Armorer, Encryptor2, Signer, LiteralWriter,
 //! };
 //! # use openpgp::parse::Parse;
 //!
@@ -102,7 +102,7 @@
 //! # let mut sink = vec![];
 //! let message = Message::new(&mut sink);
 //! let message = Armorer::new(message).build()?;
-//! let message = Encryptor::for_recipients(message, recipients).build()?;
+//! let message = Encryptor2::for_recipients(message, recipients).build()?;
 //! // Reduce metadata leakage by concealing the message size.
 //! let message = Signer::new(message, signing_keypair)
 //!     // Prevent Surreptitious Forwarding.
@@ -2106,7 +2106,7 @@ impl<'a> Recipient<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::cert::prelude::*;
     /// use openpgp::serialize::stream::{
-    ///     Recipient, Message, Encryptor,
+    ///     Recipient, Message, Encryptor2,
     /// };
     /// use openpgp::policy::StandardPolicy;
     /// # use openpgp::parse::Parse;
@@ -2142,7 +2142,7 @@ impl<'a> Recipient<'a> {
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
-    /// let message = Encryptor::for_recipients(message, recipients).build()?;
+    /// let message = Encryptor2::for_recipients(message, recipients).build()?;
     /// # let _ = message;
     /// # Ok(()) }
     /// ```
@@ -2218,7 +2218,7 @@ impl<'a> Recipient<'a> {
     /// use openpgp::KeyID;
     /// use openpgp::cert::prelude::*;
     /// use openpgp::serialize::stream::{
-    ///     Recipient, Message, Encryptor,
+    ///     Recipient, Message, Encryptor2,
     /// };
     /// use openpgp::policy::StandardPolicy;
     /// # use openpgp::parse::Parse;
@@ -2257,7 +2257,7 @@ impl<'a> Recipient<'a> {
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
-    /// let message = Encryptor::for_recipients(message, recipients).build()?;
+    /// let message = Encryptor2::for_recipients(message, recipients).build()?;
     /// # let _ = message;
     /// # Ok(()) }
     /// ```
@@ -2293,7 +2293,7 @@ impl<'a> Recipient<'a> {
 /// # use openpgp::cert::prelude::*;
 /// # use openpgp::parse::Parse;
 /// use openpgp::serialize::stream::{
-///     Message, Encryptor, LiteralWriter,
+///     Message, Encryptor2, LiteralWriter,
 /// };
 /// use openpgp::policy::StandardPolicy;
 /// let p = &StandardPolicy::new();
@@ -2326,31 +2326,33 @@ impl<'a> Recipient<'a> {
 ///
 /// # let mut sink = vec![];
 /// let message = Message::new(&mut sink);
-/// let message = Encryptor::for_recipients(message, recipients).build()?;
+/// let message = Encryptor2::for_recipients(message, recipients).build()?;
 /// let mut w = LiteralWriter::new(message).build()?;
 /// w.write_all(b"Hello world.")?;
 /// w.finalize()?;
 /// # Ok(()) }
 /// ```
-pub struct Encryptor<'a> {
+pub struct Encryptor2<'a, 'b>
+where 'b: 'a
+{
     inner: writer::BoxStack<'a, Cookie>,
     session_key: Option<SessionKey>,
-    recipients: Vec<Recipient<'a>>,
+    recipients: Vec<Recipient<'b>>,
     passwords: Vec<Password>,
     sym_algo: SymmetricAlgorithm,
     aead_algo: Option<AEADAlgorithm>,
     hash: Box<dyn crypto::hash::Digest>,
     cookie: Cookie,
 }
-assert_send_and_sync!(Encryptor<'_>);
+assert_send_and_sync!(Encryptor2<'_, '_>);
 
-impl<'a> Encryptor<'a> {
+impl<'a, 'b> Encryptor2<'a, 'b> {
     /// Creates a new encryptor for the given recipients.
     ///
-    /// To add more recipients, use [`Encryptor::add_recipients`].  To
-    /// add passwords, use [`Encryptor::add_passwords`].  To change
+    /// To add more recipients, use [`Encryptor2::add_recipients`].  To
+    /// add passwords, use [`Encryptor2::add_passwords`].  To change
     /// the symmetric encryption algorithm, use
-    /// [`Encryptor::symmetric_algo`].
+    /// [`Encryptor2::symmetric_algo`].
     ///
     /// # Examples
     ///
@@ -2360,7 +2362,7 @@ impl<'a> Encryptor<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::cert::prelude::*;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     /// use openpgp::policy::StandardPolicy;
     /// # use openpgp::parse::Parse;
@@ -2394,7 +2396,7 @@ impl<'a> Encryptor<'a> {
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
-    /// let message = Encryptor::for_recipients(message, recipients).build()?;
+    /// let message = Encryptor2::for_recipients(message, recipients).build()?;
     /// let mut w = LiteralWriter::new(message).build()?;
     /// w.write_all(b"Hello world.")?;
     /// w.finalize()?;
@@ -2402,7 +2404,7 @@ impl<'a> Encryptor<'a> {
     /// ```
     pub fn for_recipients<R>(inner: Message<'a>, recipients: R) -> Self
         where R: IntoIterator,
-              R::Item: Into<Recipient<'a>>,
+              R::Item: Into<Recipient<'b>>,
     {
         Self {
             inner: inner.into(),
@@ -2418,10 +2420,10 @@ impl<'a> Encryptor<'a> {
 
     /// Creates a new encryptor for the given passwords.
     ///
-    /// To add more passwords, use [`Encryptor::add_passwords`].  To
-    /// add recipients, use [`Encryptor::add_recipients`].  To change
+    /// To add more passwords, use [`Encryptor2::add_passwords`].  To
+    /// add recipients, use [`Encryptor2::add_recipients`].  To change
     /// the symmetric encryption algorithm, use
-    /// [`Encryptor::symmetric_algo`].
+    /// [`Encryptor2::symmetric_algo`].
     ///
     /// # Examples
     ///
@@ -2430,12 +2432,12 @@ impl<'a> Encryptor<'a> {
     /// use std::io::Write;
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
-    /// let message = Encryptor::with_passwords(
+    /// let message = Encryptor2::with_passwords(
     ///     message, Some("совершенно секретно")).build()?;
     /// let mut w = LiteralWriter::new(message).build()?;
     /// w.write_all(b"Hello world.")?;
@@ -2477,8 +2479,8 @@ impl<'a> Encryptor<'a> {
     ///   - Using the encryptor if the session key is transmitted or
     ///     derived using a scheme not supported by Sequoia.
     ///
-    /// To add more passwords, use [`Encryptor::add_passwords`].  To
-    /// add recipients, use [`Encryptor::add_recipients`].
+    /// To add more passwords, use [`Encryptor2::add_passwords`].  To
+    /// add recipients, use [`Encryptor2::add_recipients`].
     ///
     /// # Examples
     ///
@@ -2513,7 +2515,7 @@ impl<'a> Encryptor<'a> {
     ///
     /// let mut original = vec![];
     /// let message = Message::new(&mut original);
-    /// let message = Encryptor::for_recipients(message, recipients).build()?;
+    /// let message = Encryptor2::for_recipients(message, recipients).build()?;
     /// let mut w = LiteralWriter::new(message).build()?;
     /// w.write_all(b"Original message")?;
     /// w.finalize()?;
@@ -2530,7 +2532,7 @@ impl<'a> Encryptor<'a> {
     /// for p in pkesks { // Emit the stashed PKESK packets.
     ///     Packet::from(p).serialize(&mut message)?;
     /// }
-    /// let message = Encryptor::with_session_key(message, algo, sk)?.build()?;
+    /// let message = Encryptor2::with_session_key(message, algo, sk)?.build()?;
     /// let mut w = LiteralWriter::new(message).build()?;
     /// w.write_all(b"Encrypted reply")?;
     /// w.finalize()?;
@@ -2639,7 +2641,7 @@ impl<'a> Encryptor<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::cert::prelude::*;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     /// use openpgp::policy::StandardPolicy;
     /// # use openpgp::parse::Parse;
@@ -2691,7 +2693,7 @@ impl<'a> Encryptor<'a> {
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
     /// let message =
-    ///     Encryptor::with_passwords(message, Some("совершенно секретно"))
+    ///     Encryptor2::with_passwords(message, Some("совершенно секретно"))
     ///     .add_recipients(recipients)
     ///     .build()?;
     /// let mut message = LiteralWriter::new(message).build()?;
@@ -2701,7 +2703,7 @@ impl<'a> Encryptor<'a> {
     /// ```
     pub fn add_recipients<R>(mut self, recipients: R) -> Self
         where R: IntoIterator,
-              R::Item: Into<Recipient<'a>>,
+              R::Item: Into<Recipient<'b>>,
     {
         for r in recipients {
             self.recipients.push(r.into());
@@ -2722,7 +2724,7 @@ impl<'a> Encryptor<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::cert::prelude::*;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     /// use openpgp::policy::StandardPolicy;
     /// # use openpgp::parse::Parse;
@@ -2774,7 +2776,7 @@ impl<'a> Encryptor<'a> {
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
     /// let message =
-    ///     Encryptor::for_recipients(message, recipients)
+    ///     Encryptor2::for_recipients(message, recipients)
     ///         .add_passwords(Some("совершенно секретно"))
     ///         .build()?;
     /// let mut message = LiteralWriter::new(message).build()?;
@@ -2802,13 +2804,13 @@ impl<'a> Encryptor<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::types::SymmetricAlgorithm;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
     /// let message =
-    ///     Encryptor::with_passwords(message, Some("совершенно секретно"))
+    ///     Encryptor2::with_passwords(message, Some("совершенно секретно"))
     ///         .symmetric_algo(SymmetricAlgorithm::AES128)
     ///         .build()?;
     /// let mut message = LiteralWriter::new(message).build()?;
@@ -2833,13 +2835,13 @@ impl<'a> Encryptor<'a> {
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::types::AEADAlgorithm;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
     /// let message =
-    ///     Encryptor::with_passwords(message, Some("совершенно секретно"))
+    ///     Encryptor2::with_passwords(message, Some("совершенно секретно"))
     ///         .aead_algo(AEADAlgorithm::default())
     ///         .build()?;
     /// let mut message = LiteralWriter::new(message).build()?;
@@ -2877,14 +2879,14 @@ impl<'a> Encryptor<'a> {
     /// use std::io::Write;
     /// use sequoia_openpgp as openpgp;
     /// use openpgp::serialize::stream::{
-    ///     Message, Encryptor, LiteralWriter,
+    ///     Message, Encryptor2, LiteralWriter,
     /// };
     ///
     /// # let mut sink = vec![];
     /// let message = Message::new(&mut sink);
     /// let message =
-    ///     Encryptor::with_passwords(message, Some("совершенно секретно"))
-    ///         // Customize the `Encryptor` here.
+    ///     Encryptor2::with_passwords(message, Some("совершенно секретно"))
+    ///         // Customize the `Encryptor2` here.
     ///         .build()?;
     ///
     /// // Optionally add a `Padder` or `Compressor` here.
@@ -3037,7 +3039,9 @@ impl<'a> Encryptor<'a> {
     }
 }
 
-impl<'a> fmt::Debug for Encryptor<'a> {
+impl<'a, 'b> fmt::Debug for Encryptor2<'a, 'b>
+    where 'b: 'a
+{
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         f.debug_struct("Encryptor")
             .field("inner", &self.inner)
@@ -3045,7 +3049,9 @@ impl<'a> fmt::Debug for Encryptor<'a> {
     }
 }
 
-impl<'a> Write for Encryptor<'a> {
+impl<'a, 'b> Write for Encryptor2<'a, 'b>
+    where 'b: 'a
+{
     fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
         let written = self.inner.write(buf);
         if let Ok(amount) = written {
@@ -3059,7 +3065,9 @@ impl<'a> Write for Encryptor<'a> {
     }
 }
 
-impl<'a> writer::Stackable<'a, Cookie> for Encryptor<'a> {
+impl<'a, 'b> writer::Stackable<'a, Cookie> for Encryptor2<'a, 'b>
+    where 'b: 'a
+{
     fn pop(&mut self) -> Result<Option<writer::BoxStack<'a, Cookie>>> {
         unreachable!("Only implemented by Signer")
     }
@@ -3090,6 +3098,167 @@ impl<'a> writer::Stackable<'a, Cookie> for Encryptor<'a> {
     }
 }
 
+/// Encrypts a message.
+///
+/// Use [`Encryptor2`] instead.  `Encryptor2` is exactly the same as
+/// `Encryptor`, but `Encryptor` only uses a single lifetime, which is
+/// in some situations is too restrictive.  `Encryptor2` fixes that
+/// issue without breaking the API.
+#[deprecated(note = "Use Encryptor2 instead")]
+pub struct Encryptor<'a> {
+    inner: Encryptor2<'a, 'a>,
+}
+// We can't use #[allow(deprecated)] on assert_send_and_sync, but we
+// can put it in a module and allow deprecated symbols within the
+// module.
+#[allow(deprecated)]
+mod encryptor_assert_send_and_sync {
+    use super::Encryptor;
+    assert_send_and_sync!(Encryptor<'_>);
+}
+
+#[allow(deprecated)]
+impl<'a> Encryptor<'a> {
+    /// Creates a new encryptor for the given recipients.
+    ///
+    /// See [`Encryptor2::for_recipients`].
+    pub fn for_recipients<R>(inner: Message<'a>, recipients: R) -> Self
+        where R: IntoIterator,
+              R::Item: Into<Recipient<'a>>,
+    {
+        Encryptor {
+            inner: Encryptor2::for_recipients(inner, recipients),
+        }
+    }
+
+    /// Creates a new encryptor for the given passwords.
+    ///
+    /// See [`Encryptor2::with_passwords`].
+    pub fn with_passwords<P>(inner: Message<'a>, passwords: P) -> Self
+        where P: IntoIterator,
+              P::Item: Into<Password>,
+    {
+        Encryptor {
+            inner: Encryptor2::with_passwords(inner, passwords),
+        }
+    }
+
+    /// Creates a new encryptor for the given algorithm and session
+    /// key.
+    ///
+    /// See [`Encryptor2::with_session_key`].
+    pub fn with_session_key(inner: Message<'a>,
+                            sym_algo: SymmetricAlgorithm,
+                            session_key: SessionKey)
+                            -> Result<Self>
+    {
+        Ok(Encryptor {
+            inner: Encryptor2::with_session_key(inner, sym_algo, session_key)?,
+        })
+    }
+
+    /// Adds recipients.
+    ///
+    /// See [`Encryptor2::add_recipients`].
+    pub fn add_recipients<R>(self, recipients: R) -> Self
+        where R: IntoIterator,
+              R::Item: Into<Recipient<'a>>,
+    {
+        Encryptor {
+            inner: self.inner.add_recipients(recipients),
+        }
+    }
+
+    /// Adds passwords to encrypt with.
+    ///
+    /// See [`Encryptor2::add_passwords`].
+    pub fn add_passwords<P>(self, passwords: P) -> Self
+        where P: IntoIterator,
+              P::Item: Into<Password>,
+    {
+        Encryptor {
+            inner: self.inner.add_passwords(passwords),
+        }
+    }
+
+    /// Sets the symmetric algorithm to use.
+    ///
+    /// See [`Encryptor2::symmetric_algo`].
+    pub fn symmetric_algo(self, algo: SymmetricAlgorithm) -> Self {
+        Encryptor {
+            inner: self.inner.symmetric_algo(algo),
+        }
+    }
+
+    /// Enables AEAD and sets the AEAD algorithm to use.
+    ///
+    /// See [`Encryptor2::aead_algo`].
+    #[cfg(test)]
+    pub fn aead_algo(self, algo: AEADAlgorithm) -> Self {
+        Encryptor {
+            inner: self.inner.aead_algo(algo),
+        }
+    }
+
+    /// Builds the encryptor, returning the writer stack.
+    ///
+    /// See [`Encryptor2::build`].
+    pub fn build(self) -> Result<Message<'a>> {
+        self.inner.build()
+    }
+}
+
+#[allow(deprecated)]
+impl<'a> fmt::Debug for Encryptor<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.inner.fmt(f)
+    }
+}
+
+#[allow(deprecated)]
+impl<'a> Write for Encryptor<'a> {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        self.inner.write(buf)
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        self.inner.flush()
+    }
+}
+
+#[allow(deprecated)]
+impl<'a> writer::Stackable<'a, Cookie> for Encryptor<'a>
+{
+    fn pop(&mut self) -> Result<Option<writer::BoxStack<'a, Cookie>>> {
+        self.inner.pop()
+    }
+    /// Sets the inner stackable.
+    fn mount(&mut self, new: writer::BoxStack<'a, Cookie>) {
+        self.inner.mount(new)
+    }
+    fn inner_ref(&self) -> Option<&(dyn writer::Stackable<'a, Cookie> + Send + Sync)> {
+        self.inner.inner_ref()
+    }
+    fn inner_mut(&mut self) -> Option<&mut (dyn writer::Stackable<'a, Cookie> + Send + Sync)> {
+        self.inner.inner_mut()
+    }
+    fn into_inner(self: Box<Self>) -> Result<Option<writer::BoxStack<'a, Cookie>>> {
+        Box::new(self.inner).into_inner()
+    }
+    fn cookie_set(&mut self, cookie: Cookie) -> Cookie {
+        self.inner.cookie_set(cookie)
+    }
+    fn cookie_ref(&self) -> &Cookie {
+        self.inner.cookie_ref()
+    }
+    fn cookie_mut(&mut self) -> &mut Cookie {
+        self.inner.cookie_mut()
+    }
+    fn position(&self) -> u64 {
+        self.inner.position()
+    }
+}