# Crypto `deft/stdext/crypto` is a thin, package-pinned alias layer over the native `crypto/*` stdlib family, plus two convenience generators. It adds no new cryptography — the native namespace is the canonical reference (see Crypto), and this page only covers the wrapper deltas.

import "deft/stdext/crypto" as crypto

## API | Def | Signature | Forwards to | |---|---|---| | `hash` | `{| data algorithm |}` | `crypto/hash` — hex digest | | `sha256` / `sha512` / `blake3` / `md5` | `{| data |}` | dedicated hashes (hex) | | `hmac` | `{| algorithm key data |}` | `crypto/hmac` — hex | | `rand-bytes` | `{| n |}` | `crypto/rand` — vector of byte numbers | | `rand-hex` | `{| n |}` | `crypto/rand-hex` — 2n-char hex | | `b64-encode` / `b64-decode` | `{| data |}` | base64 (padded) | | `hex-encode` / `hex-decode` | `{| data |}` | hex | | `encrypt` | `{| key nonce plaintext aad |}` | ChaCha20-Poly1305; `%Encrypted{:ciphertext :tag}` | | `decrypt` | `{| key nonce ciphertext tag aad |}` | plaintext or `%Err` | | `rand-key` | `{||}` | 32-byte key as 64 hex chars | | `rand-nonce` | `{||}` | 12-byte nonce as 24 hex chars | ## Wrapper Deltas - `encrypt` / `decrypt` fix the algorithm to ChaCha20-Poly1305 and make `aad` a required argument (the native function allows it optional). - `rand-bytes` is the wrapper name for native `crypto/rand`. - `rand-key` / `rand-nonce` are convenience generators not present in the native namespace. Keys are 32-byte (64 hex), nonces 12-byte (24 hex), tags 16-byte (32 hex). The AAD is authenticated but not encrypted and must match at decrypt time.

def key   [crypto/rand-key]
def nonce [crypto/rand-nonce]
def sealed [crypto/encrypt $key $nonce "secret message" "aad"]
set plain  [crypto/decrypt $key $nonce $sealed~ciphertext $sealed~tag "aad"]

## See Also - Crypto — the full native `crypto/*` reference - Strings — binary strings are byte containers; use `bytes/*` for slicing