Cryptography

Decrypt AES ciphertext using its key, initialization vector, and cipher mode. Use it to recover data written by the matching encryption call. The key, mode, and IV must agree with encryption; catch errors when reading damaged or untrusted ciphertext.

Encrypt a byte string with AES and return both the Base64 ciphertext and its initialization vector. Use it when stored data needs confidentiality. The GCM example also authenticates the ciphertext; keep the key separate from the saved ciphertext and IV.

Generate random bytes and return them encoded as Base64. Use it when a random value must already be printable, such as a randomly generated local label. Requesting 16 bytes does not mean the Base64 result has 16 characters.

Generate a random 32-byte key for the crypt library. Use it to create a key in the format crypt.encrypt expects. Generate it once for the data you intend to decrypt later; generating a new key cannot recover old ciphertext.

Compute a digest of the supplied data using the selected algorithm. Use it to fingerprint file contents or compare whether bytes have changed. A hash does not encrypt data, and a plain digest does not authenticate its sender.

Compute a keyed message authentication code for a byte string. Use it to authenticate a message with a shared secret key. Unlike an unkeyed hash, reproducing the tag requires the same key as well as the same message.

Generate random bytes as a raw string. Use it when an operation expects raw random bytes rather than a printable string. Convert to Base64 for display or text storage.