CheckNonce tests if a nonce matches the hashed version of it.

HashNonce returns the BLAKE2b 256-bit hash of a nonce NOTE: Error checking (G104) is purposefully skipped: - `blake2b.New256` has no error path with a nil signing key - `hash.Hash` interface's `Write` has an error signature, but `blake2b.digest.Write` does not use it.

NewBase64Cipher returns a new AES Cipher for encrypting cookie values and wrapping them in Base64 -- Supports Legacy encryption scheme.

NewCFBCipher returns a new AES CFB Cipher.

NewGCMCipher returns a new AES GCM Cipher.

Nonce generates a random n-byte slice.

SecretBytes attempts to base64 decode the secret, if that fails it treats the secret as binary.

SignedValue returns a cookie that is signed and can later be checked with Validate.

Validate ensures a cookie is properly signed.

Cipher provides methods to encrypt and decrypt.