std/cipher

Authenticated encryption: ChaCha20Poly1305, the AEAD of RFC 8439 section 2.8, in TorbScript with no native. A key of 32 bytes seals a message with a nonce of 12 bytes and any associated data, and opens it again only if neither the message, the associated data, the nonce nor the tag changed. Sealing hides what a message says and the tag says who made it; a digest (std/digest) does neither, and a signature (std/signature) is for a reader who holds no key.

ChaCha20 (section 2.4) and Poly1305 (section 2.5) are not exported from the package: nobody can use the cipher without its tag, or the tag with a key that was used twice. CipherError says why a key or a nonce is not one, and that bytes do not open.