Decrypt reverses Encrypt.

DerivePassword performs a one-way hash on a password using argon2.

EncodedSHA256 returns the encoded (base16) sha256sums.

Encrypt returns the hex-encoded AES symmetric encryption of s with key.

MakeKey returns a 32-len byte slice.

NewVersionKey creates a new VersionKey assuming current is a valid key in `keyMap`.

RandKey returns a new random key.

RandString is a RandKey wrapped in a hex-encoded sha256.

VerifyPassword returns true if guess is the same as the password forming `derived`.

KeyLen is the encryption key length.

ErrDigest signals a checksum mismatch.

ErrNonce signals a failure to construct the nonce.

VersionKey maps key ids (as UUIDs) to key []byte and knows the current key id -> key []byte mapping.

KeyMap is the data structure used to hold key ids (as UUIDs) -> key []byte.