Symmetric Ciphers and Modes

import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
function encryptField(key: Buffer, plaintext: string, customerId: string) {
  const iv = randomBytes(12);
  const c = createCipheriv('aes-256-gcm', key, iv); c.setAAD(Buffer.from(customerId));
  const ct = Buffer.concat([c.update(plaintext, 'utf8'), c.final()]);
  return Buffer.concat([iv, c.getAuthTag(), ct]).toString('base64');      // store iv ‖ tag ‖ ciphertext
}
function decryptField(key: Buffer, blob: string, customerId: string) {
  const b = Buffer.from(blob, 'base64'), iv = b.subarray(0, 12), tag = b.subarray(12, 28), ct = b.subarray(28);
  const d = createDecipheriv('aes-256-gcm', key, iv); d.setAAD(Buffer.from(customerId)); d.setAuthTag(tag);
  return Buffer.concat([d.update(ct), d.final()]).toString('utf8');       // throws if tampered or wrong customer
}