Reintroduce Alleged IDEA

All the patents on IDEA have now expired. The trademark on the name remains, hence "Alleged IDEA". This pull request is based on the original IDEA code from dlitz/pycrypto@v2.0.1 which was removed in dlitz/pycrypto@v2.1.0alpha1.

All tests pass as expected.
Quoting Dwayne Litzenberger <notifications@github.com>:
>> +There are no publicly known attacks against AIDEA (3050 K/sec), and
>> +it's been around long enough to have been examined.
>> +
>
> This is misleading.  Yes, IDEA has been examined, and it's known to 
> be vulnerable against plaintext-recovery attacks, which are feasible 
> after an expected 2^32 blocks due to its 64-bit block size.  See 
> https://eprint.iacr.org/2012/623

That is a very good reference!

Still, this birthday paradox-based attack applies to *all* the block 
ciphers. It
is hardly a weakness specific to IDEA. Naturally, for the block ciphers with
64-bit block, the expected number of blocks is 2^32, while for the 
ciphers with
128-bit block it is 2^64. Still, there are reasons for people to use ciphers
with a shorter block length (consider the recent release of SIMON and SPECK
algorithms). And the excellent paper you cited explicitly states that 64-bit
block ciphers are fine in case of "...very low data rates and keys are changed
often." I see no reason to restrict IDEA to decrypting old messages only.

If I could have my way, the original RIJNDAEL would get a few more rounds
(anything between 2 and 4 would be find) and become the new standard, with a
option of 256-bit block (rather than cutting off 256-bit block option and
leaving the # of rounds as is). But in practice we may need blocks 
shorter than
128 bits.