Google Tink: Safe High-Level Crypto

Tink is an open-source cryptographic library developed by Google's cryptography team, designed to provide safe and easy-to-use cryptography. The primary motivation is preventing the common cryptographic misuse patterns that occur even among experienced developers using lower-level libraries. Tink's API is designed so that the correct operation is the path of least resistance, making it difficult to accidentally create insecure configurations.

Tink organizes keys into keysets rather than exposing individual key objects. Applications work with keyset handles, not raw key bytes. This abstraction prevents accidental key exposure, enables seamless key rotation, and allows keys to be stored in remote Key Management Systems without the application ever seeing the key material directly. The keyset concept is central to Tink's safe design.