Encrypts data using AES-256-GCM.
Returns (ciphertext, nonce, tag) combined or separate?
3MF Spec: Content Encryption usually has IV/Nonce separately or prepended.
“The Key used is the Content Encryption Key (CEK).”
“The Algorithm is AES-256-GCM.”
Nonce is 12 bytes (96 bits).
Tag is 16 bytes (128 bits).
Output usually: Nonce + Ciphertext (which includes Tag usually in Rust implementation?)
Rust aes-gcm crate returns ciphertext + tag.