Skip to content
Packet Loom markminiproto

miniproto.crypto.native.aes_256_gcm_encrypt

miniproto.crypto.native.aes_256_gcm_encrypt

Section titled “miniproto.crypto.native.aes_256_gcm_encrypt”
aes_256_gcm_encrypt(plaintext: bytes, key: bytes, nonce: bytes, associated_data: bytes) -> bytes

Encrypt and authenticate session bytes with AES-256-GCM.

Parameters:

  • plaintext (bytes) – Bytes to protect.
  • key (bytes) – Exactly 32 bytes of AES-256 key material.
  • nonce (bytes) – Exactly 12 bytes and unique for this key.
  • associated_data (bytes) – Authenticated but unencrypted bytes.

Returns:

  • bytes – Ciphertext followed by the 16-byte GCM authentication tag.

Raises:

  • ValueError – If the key or nonce is invalid, or the backend rejects encryption.

Uses Rust only when that optional session-crypto symbol exists; otherwise uses cryptography. Both routes preserve the same wire result. Nonce uniqueness remains a caller requirement and is not tracked here.

miniproto

Fast paths where they count. Explicit boundaries everywhere else.