Answer: Secure Cell is Themis's symmetric authenticated encryption primitive for data at rest, taking a key or passphrase plus an optional context and returning ciphertext that cannot be decrypted or tampered with without both. It is what you reach for when encrypting a local cache, a SQLite blob, or a value before writing it to the Keychain.

The optional context is associated data: it is authenticated but not stored in the ciphertext. Binding a record's primary key as context means an attacker cannot move an encrypted row to a different record, because decryption with a different context fails.

Code Example:

import themis

let cell = TSCellSeal(key: symmetricKey)!   // symmetricKey: Data, 32 bytes
let plaintext = "4111 1111 1111 1111".data(using: .utf8)!

// Context binds the ciphertext to this specific record.
let context = "card:\(cardID)".data(using: .utf8)!
let encrypted = try cell.encrypt(plaintext, context: context)

// Decryption fails if key, context, or ciphertext was altered.
let decrypted = try cell.decrypt(encrypted, context: context)

Key Points:

• Authenticated encryption — tampering throws instead of returning garbage.
• Context is not stored, so you must supply the identical value on decrypt.
• Lose the key and the data is unrecoverable; there is no escrow.