Which four primitives does Themis provide, and what is each one for?

Answer: Themis exposes Secure Cell for encrypting data at rest, Secure Message for encrypting or signing individual payloads between two parties, Secure Session for an encrypted stateful channel over an untrusted transport, and Secure Comparator for proving two sides share a secret without revealing it.

Primitive	Objective-C/Swift class	Problem it solves
Secure Cell	TSCellSeal, TSCellToken, TSCellContextImprint	Data at rest — local database, cached files, Keychain blobs
Secure Message	TSMessage	One-shot encrypt or sign of a discrete payload
Secure Session	TSSession	Long-lived encrypted channel with forward secrecy
Secure Comparator	TSComparator	Zero-knowledge proof of a shared secret

Picking the wrong one is the most common integration mistake: Secure Session for a stateless REST API adds a handshake you cannot maintain, and Secure Cell for client-server traffic gives you a symmetric key that both ends must already share.

Key Points:

• Secure Cell is symmetric; Secure Message and Secure Session are asymmetric.
• Secure Message is stateless — ideal for request/response APIs.
• Secure Session is stateful and needs a persistent connection.