code: def encrypt(content, salt=None, key=None,
              private_key=None, dh=None, auth_secret=None,
              keyid=None, keylabel="P-256",
              rs=4096, version="aes128gcm"):
      def encrypt_record(key, nonce, counter, buf, last):
          encryptor = Cipher(
              algorithms.AES(key),
              modes.GCM(iv(nonce, counter)),
              backend=default_backend()
          ).encryptor()
          if version == 'aes128gcm':
              data = encryptor.update(buf + (b'\x02' if last else b'\x01'))
          else:
              data = encryptor.update((b"\x00" * versions[version]['pad']) + buf)
          data += encryptor.finalize()
          data += encryptor.tag
          return data
      def compose_aes128gcm(salt, content, rs, keyid):
          if len(keyid) > 255:
              raise ECEException("keyid is too long")
          header = salt
          if rs > MAX_RECORD_SIZE:
              raise ECEException("Too much content")
          header += struct.pack("!L", rs)
          header += struct.pack("!B", len(keyid))
          header += keyid
          return header + content
      if version not in versions:
          raise ECEException(u"Invalid version")
      if salt is None:
          salt = os.urandom(16)
      (key_, nonce_) = derive_key("encrypt", version=version,
                                  salt=salt, key=key,
                                  private_key=private_key, dh=dh,
                                  auth_secret=auth_secret,
                                  keyid=keyid, keylabel=keylabel)
      overhead = versions[version]['pad']
      if version == 'aes128gcm':
          overhead += 16
          end = len(content)
      else:
          end = len(content) + 1
      if rs <= overhead:
          raise ECEException(u"Record size too small")
      chunk_size = rs - overhead
      result = b""
      counter = 0
      for i in list(range(0, end, chunk_size)):
          result += encrypt_record(key_, nonce_, counter,
                                   content[i:i + chunk_size],
                                   (i + chunk_size) >= end)
          counter += 1
      if version == "aes128gcm":
          if keyid is None and private_key is not None:
              kid = private_key.public_key().public_bytes(
                  Encoding.X962,
                  PublicFormat.UncompressedPoint)
          else:
              kid = (keyid or '').encode('utf-8')
          return compose_aes128gcm(salt, result, rs, keyid=kid)
      return result