class ChunkEncryptor {

    public EncryptedChunk encrypt(ChunkHash plaintextHash, byte[] plaintext)
            throws InvalidKeyException, IllegalBlockSizeException {
        byte[] nonce = generateNonce();
        Cipher cipher;
        try {
            cipher = Cipher.getInstance(CIPHER_ALGORITHM);
            cipher.init(
                    Cipher.ENCRYPT_MODE,
                    mSecretKey,
                    new GCMParameterSpec(GCM_TAG_LENGTH_BYTES * 8, nonce));
        } catch (NoSuchAlgorithmException
                | NoSuchPaddingException
                | InvalidAlgorithmParameterException e) {
            // This can not happen - AES/GCM/NoPadding is supported.
            throw new AssertionError(e);
        }
        byte[] encryptedBytes;
        try {
            encryptedBytes = cipher.doFinal(plaintext);
        } catch (BadPaddingException e) {
            // This can not happen - BadPaddingException can only be thrown in decrypt mode.
            throw new AssertionError("Impossible: threw BadPaddingException in encrypt mode.");
        }

        return EncryptedChunk.create(/*key=*/ plaintextHash, nonce, encryptedBytes);
    }

    public  ChunkEncryptor(SecretKey secretKey, SecureRandom secureRandom);

}