def encrypt(content, salt=None, key=None,
            private_key=None, dh=None, auth_secret=None,
            keyid=None, keylabel="P-256",
            rs=4096, version="aes128gcm"):
    def encrypt_record(key, nonce, counter, buf, last):
        encryptor = Cipher(
            algorithms.AES(key),
            modes.GCM(iv(nonce, counter)),
            backend=default_backend()
        ).encryptor()
        if version == 'aes128gcm':
            data = encryptor.update(buf + (b'\x02' if last else b'\x01'))
        else:
            data = encryptor.update((b"\x00" * versions[version]['pad']) + buf)
        data += encryptor.finalize()
        data += encryptor.tag
        return data
    def compose_aes128gcm(salt, content, rs, keyid):
        if len(keyid) > 255:
            raise ECEException("keyid is too long")
        header = salt
        if rs > MAX_RECORD_SIZE:
            raise ECEException("Too much content")
        header += struct.pack("!L", rs)
        header += struct.pack("!B", len(keyid))
        header += keyid
        return header + content
    if version not in versions:
        raise ECEException(u"Invalid version")
    if salt is None:
        salt = os.urandom(16)
    (key_, nonce_) = derive_key("encrypt", version=version,
                                salt=salt, key=key,
                                private_key=private_key, dh=dh,
                                auth_secret=auth_secret,
                                keyid=keyid, keylabel=keylabel)
    overhead = versions[version]['pad']
    if version == 'aes128gcm':
        overhead += 16
        end = len(content)
    else:
        end = len(content) + 1
    if rs <= overhead:
        raise ECEException(u"Record size too small")
    chunk_size = rs - overhead
    result = b""
    counter = 0
    for i in list(range(0, end, chunk_size)):
        result += encrypt_record(key_, nonce_, counter,
                                 content[i:i + chunk_size],
                                 (i + chunk_size) >= end)
        counter += 1
    if version == "aes128gcm":
        if keyid is None and private_key is not None:
            kid = private_key.public_key().public_bytes(
                Encoding.X962,
                PublicFormat.UncompressedPoint)
        else:
            kid = (keyid or '').encode('utf-8')
        return compose_aes128gcm(salt, result, rs, keyid=kid)
    return result