anchor.diff:  encrypt(Plaintext, Key, IV, Timestamp) ->
       {SigningKey, EncryptionKey} = decode_key(Key),
       PaddedPlaintext = pkcs7:pad(Plaintext),
  -    io:format("Padded plaintext: ~w~n", [PaddedPlaintext]),
       Ciphertext = crypto:block_encrypt(aes_cbc128, EncryptionKey, IV, PaddedPlaintext),
       Message = encode_message(Timestamp, IV, Ciphertext),
       HMAC = hmac_sha256(SigningKey, Message),
  
positive.code:             valid
      end,
      PaddedPlaintext = crypto:block_decrypt(aes_cbc128, EncryptionKey, IV, Ciphertext),
      io:format("Padded plaintext: ~w~n", [PaddedPlaintext]),
      pkcs7:unpad(PaddedPlaintext).
  
  encrypt(Plaintext, Key) ->
  
negative.code: decode_key(Key) ->
      KeyBin = base64url:decode(Key),
      <<SigningKey:128/bitstring, EncryptionKey:128/bitstring>> = KeyBin,
      {SigningKey, EncryptionKey}.
  
  generate_key() ->
      base64url:encode(crypto:strong_rand_bytes(256 div 8)).
  
  decrypt(Token, Key) ->
      decrypt(Token, Key, none).
  