Module cipher 

Encryption and decryption — the one pair of functions every path shares.

AES-256-SIV (RFC 5297) is a deterministic AEAD: the synthetic IV is computed from the content, so identical plaintext under identical key yields byte identical ciphertext. That is not a workaround, it is the construction, and it is what keeps git status quiet on an unchanged file.

Functions

blob_key_id

The key fingerprint a blob claims, without needing the key itself.

decrypt

Decrypts a blob produced by encrypt, returning its flags and plaintext.

encrypt

Encrypts plaintext, recording flags in the authenticated header.