Module cipher 

The cipher primitive kind: unauthenticated symmetric encryption (confidentiality only), served for compatibility with WebCrypto-committed formats. See README.md, “Design notes”, “Unauthenticated modes are in, for compatibility”.

Security:

• Nothing here authenticates. Ciphertext is malleable — an attacker can make targeted edits to the decrypted plaintext without the key — and a successful decrypt is not evidence the ciphertext is untampered. Default to the aead kind; use this one only where an existing format fixes the mode.
• decrypt failures are deliberately uniform: every malformed-input condition (for AES-CBC, a bad final padding block among them) fails error.other with no distinguishing detail. Implementations MUST NOT reveal why a decryption failed — a distinguishable padding verdict is a padding-oracle amplifier.
• IV discipline is the algorithm’s contract (unpredictability for CBC, per-key uniqueness for CTR counter blocks); the minting interface documents it. The caller owns it, as with aead nonces.

Structs

CipherKey

An unauthenticated-cipher key: an unforgeable capability, bound to one algorithm at creation. The streaming, extractability, and getter contracts in README.md apply, and so do this interface’s Security notes — nothing this key does authenticates.

CipherKeyOptions

Mint-time policy for a cipher-key. Grants nothing by default; see README.md, “Key-options contract”.

Type Aliases

Error

UnwrapInput

WrapInput