Module crypto 

Authenticated encryption (AES-256-GCM) for cookies and credentials.

encrypt/decrypt take an arbitrary-length secret (e.g. an app’s secret_key_base or master.key), derive a 32-byte key from it with SHA-256, and produce/consume a nonce(12) || ciphertext+tag blob. GCM’s authentication tag means a tampered blob fails to decrypt (returns None), so this both hides and authenticates the payload.

Shared by the session cookie store (doido-controller) and encrypted credentials (doido-generators).

Functions

decrypt

Decrypt a nonce || ciphertext+tag blob produced by encrypt. Returns None when the blob is truncated, the secret is wrong, or the tag fails to authenticate (tampering).

encrypt

Encrypt plaintext under secret, returning nonce || ciphertext+tag.

generate_key_hex

Generate a random 32-byte secret, hex-encoded (64 chars) — e.g. an app’s master.key for encrypted credentials.

key_from_secret

Derive a 32-byte AES-256 key from an arbitrary-length secret via SHA-256.