Hm. I don't buy the "implementation matters" argument. If AES-128-GCM is broken in a library or language that'd be a pretty big deal. Cipher implementations sho

Hm. I don't buy the "implementation matters" argument. If AES-128-GCM is broken in a library or language that'd be a pretty big deal. Cipher implementations should be interoperable, otherwise you'd have a big problem. Your other argument is totally valid. If a cipher becomes exploitable, you'd treat it the same way as you would with password hashes. You'd need to re-encrypt. password_hash() is designed to hash with today's best hash. My question was mainly about the file format though. The encrypt/decrypt functions would be a simple perk that becomes possible if we had that. Edit: encrypt->hash