feat(crypto): AES-256-GCM password encryption

internal/crypto/crypto_test.go

@@ -0,0 +1,33 @@
+package crypto
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestEncryptDecryptRoundTrip(t *testing.T) {
+	key := make([]byte, 32)
+	enc, err := Encrypt(key, []byte("hunter2"))
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	if enc == "hunter2" {
+		t.Fatal("ciphertext must not equal plaintext")
+	}
+	got, err := Decrypt(key, enc)
+	if err != nil {
+		t.Fatalf("decrypt: %v", err)
+	}
+	if !bytes.Equal(got, []byte("hunter2")) {
+		t.Fatalf("got %q, want hunter2", got)
+	}
+}
+
+func TestEncryptNonDeterministic(t *testing.T) {
+	key := make([]byte, 32)
+	a, _ := Encrypt(key, []byte("x"))
+	b, _ := Encrypt(key, []byte("x"))
+	if a == b {
+		t.Fatal("two encryptions must differ (random nonce)")
+	}
+}