Cipher

Authenticated AES-256-GCM in a versioned envelope: header, key id, random IV, ciphertext and tag in one value. Tampering — including with the header — is detected, not decrypted. Rotate the key and old payloads still decrypt.