Decrypts a cookie value produced by encrypted_cookie. Returns the
original value on success. Returns None on any failure — malformed
input, the wrong key, or a tampered/corrupted ciphertext (GCM’s
authentication tag check fails closed rather than returning garbage).
Encrypts value with AES-256-GCM. key may be any length — it’s hashed
with SHA-256 first to produce the required 256-bit key, the same
convenience signed_cookie’s HMAC secret already offers. A fresh
random 96-bit nonce is generated on every call. Returns
"<hex-nonce>.<hex-ciphertext-and-tag>" — store the result directly as a
cookie value.
Signs value with HMAC-SHA256 keyed by secret. Returns
"<value>.<hex-signature>" — store the result directly as a cookie value
(e.g. SetCookie::new("prefs", signed_cookie(value, secret))).
Verifies a cookie value produced by signed_cookie. Returns the
original value on success. Returns None on any failure — missing
separator, malformed hex, or a signature mismatch (tampering, or the
wrong secret).