func (e *AESGCMEncryptor) Encrypt(plaintext []byte) (*EncryptedData, error) {
	nonce := make([]byte, e.gcm.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return nil, err
	}
	return &EncryptedData{
		Ciphertext: e.gcm.Seal(nonce, nonce, plaintext, nil),
		Type:       AESGCM,
	}, nil
}
Encrypt generates a unique nonce for each encryption, and encrypts the
plain-text secret with the configured AES key.
package encryptor
import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"io"
)
type AESGCMEncryptor struct {
	gcm cipher.AEAD
}
func NewAESGCM(aesKey []byte) (*AESGCMEncryptor, error) {
	block, err := aes.NewCipher(aesKey)
	if err != nil {
		return nil, ErrKeyTooShort
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	return &AESGCMEncryptor{gcm: gcm}, nil
}