cadrumo.adapters.persistence.storage.crypto.aes_gcm module

AES-256-GCM sealing with a fresh random nonce, on plain bytes.

The one AES-GCM implementation. aead wraps it in the typed EncryptedBlob record and the storage error hierarchy; the supervised key-derivation child calls it directly. That child is started for every wrap and unwrap, so this module imports only cryptography and the standard library – no pydantic, no error hierarchy – and reports failures as the builtin and cryptography exceptions its callers translate.

NONCE_SIZE: Final

AES-256-GCM nonce size in bytes (per NIST SP 800-38D).

GCM_TAG_SIZE: Final

AES-256-GCM authentication-tag size in bytes.

KEY_SIZE: Final

AES-256 key size in bytes.

seal(plaintext, *, key, associated_data=None)[source]

Encrypt plaintext under a fresh random nonce.

Return type:

tuple[bytes, bytes]

Returns:

(nonce, ciphertext_with_tag); the tag is the trailing GCM_TAG_SIZE bytes.

Raises:

  • ValueError – If key is not exactly KEY_SIZE bytes, or the underlying AEAD operation refuses its input.

  • TypeError – If the underlying AEAD operation refuses its input type.

Parameters:
open_sealed(nonce, ciphertext, *, key, associated_data=None)[source]

Decrypt ciphertext (with its trailing tag) and verify it.

Raises:

  • cryptography.exceptions.InvalidTag – If authentication fails.

  • ValueError – If key is not exactly KEY_SIZE bytes, or the underlying AEAD operation refuses its input.

  • TypeError – If the underlying AEAD operation refuses its input type.

Return type:

bytes

Parameters: