This is low-level cryptography. It must only be used for
implementing high-level constructions. It must only be used
as a fallback for platforms without AES intrinsics. Do NOT
use this code unless you know exactly what you are doing. If
in doubt, use aes-gcm instead.