func (m *masterLockPBKDF2) Encrypt(keyURI string, req *secretlock.EncryptRequest) (*secretlock.EncryptResponse, error) {
	if len(req.Plaintext) != m.h().Size() {
		return nil, fmt.Errorf("invalid key size")
	}
	nonce := random.GetRandomBytes(uint32(m.aead.NonceSize()))
	ct := m.aead.Seal(nil, nonce, []byte(req.Plaintext), []byte(req.AdditionalAuthenticatedData))
	ct = append(nonce, ct...)
	return &secretlock.EncryptResponse{
		Ciphertext: base64.URLEncoding.EncodeToString(ct),
	}, nil
}
Encrypt a master key in req
(keyURI is used for remote locks, it is ignored by this implementation)
package pbkdf2
import (
	"crypto/cipher"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"hash"
	"github.com/google/tink/go/subtle/random"
	"golang.org/x/crypto/pbkdf2"
	"github.com/hyperledger/aries-framework-go/pkg/secretlock"
	cipherutil "github.com/hyperledger/aries-framework-go/pkg/secretlock/local/internal/cipher"
)
type masterLockPBKDF2 struct {
	h    func() hash.Hash
	salt []byte
	aead cipher.AEAD
}
func NewMasterLock(passphrase string, h func() hash.Hash, iterations int, salt []byte) (secretlock.Service, error) {
	if passphrase == "" {
		return nil, fmt.Errorf("passphrase is empty")
	}
	if h == nil {
		return nil, fmt.Errorf("hash is nil")
	}
	size := h().Size()
	if size > sha256.Size {  
		return nil, fmt.Errorf("hash size not supported")
	}
	masterKey := pbkdf2.Key([]byte(passphrase), salt, iterations, sha256.Size, h)
	aead, err := cipherutil.CreateAESCipher(masterKey)
	if err != nil {
		return nil, err
	}
	return &masterLockPBKDF2{
		h:    h,
		salt: salt,
		aead: aead,
	}, nil
}