otp_crypto/otp_cipher library

OTP Crypto – AES-256-CBC with PKCS#7 padding (via encrypt package)

Thin wrapper around package:encrypt to perform AES-256-CBC encryption and decryption with PKCS#7 padding. This class does not derive keys or IVs; it only consumes the encKey (32B) and iv (16B) provided by higher layers (HKDF + IV derivation).

SECURITY NOTES:

  • Enforce key length (32) and IV length (16) before calling AES.
  • This layer performs no MAC verification; always verify the HMAC tag (Encrypt-then-MAC) before decryption at a higher layer.
  • Catch and wrap low-level errors to avoid leaking internals.

HINTS:

  • Use encrypt(...) to obtain ciphertext bytes for the wire header c.
  • Use decrypt(...) only after tag verification passes.

Classes

OtpCipher