encrypt

aes-gcm with passphrase + pbkdf2