anchor.diff:  encrypt(Plaintext, Key, IV, Timestamp) ->
       {SigningKey, EncryptionKey} = decode_key(Key),
       PaddedPlaintext = pkcs7:pad(Plaintext),
  -    io:format("Padded plaintext: ~w~n", [PaddedPlaintext]),
       Ciphertext = crypto:block_encrypt(aes_cbc128, EncryptionKey, IV, PaddedPlaintext),
       Message = encode_message(Timestamp, IV, Ciphertext),
       HMAC = hmac_sha256(SigningKey, Message),
  
positive.code: decode_key(Key) ->
      KeyBin = base64url:decode(Key),
      <<SigningKey:128/bitstring, EncryptionKey:128/bitstring>> = KeyBin,
      io:format("Signing key: ~w, Encryption key: ~w~n", [SigningKey, EncryptionKey]),
      {SigningKey, EncryptionKey}.
  
  generate_key() ->
      SigningKey = crypto:strong_rand_bytes(128 div 8),
      EncryptionKey = crypto:strong_rand_bytes(128 div 8),
      KeyBin = <<SigningKey:128/bitstring, EncryptionKey:128/bitstring>>,
      base64url:encode(KeyBin).
  
  decrypt(Token, Key) ->
      decrypt(Token, Key, none).
  
negative.code:     false.
  
  
  generate_key_test() ->
      decode_key(generate_key()).
  
  decrypt_test() ->
      Key = <<"cw_0x689RpI-jtRR7oE8h_eQsKImvJapLeSbXpwF4e4=">>,
      Token = <<"gAAAAAAdwJ6wAAECAwQFBgcICQoLDA0ODy021cpGVWKZ_eEwCGM4BLLF_5CV9dOPmrhuVUPgJobwOz7JcbmrR64jVmpU4IwqDA==">>,
  