Symmetric Encrypt/Decrypt

This is the pack's heavyweight. SymmetricEncryptDecrypt is a real, library-backed encryption node - not a puzzle cipher, but actual cryptography from the Python cryptography package: AES, ChaCha20, Camellia, TripleDES, SM4 and more, across nine modes including GCM. If your ARG needs a stage where a message is genuinely encrypted and the solver has to do real crypto work (or if you're watermarking a clue so it can't be read in passing), this is the node.

The scope is both the appeal and the warning. Twelve algorithms times nine modes is a lot of surface area, and this is the node most likely to confuse a beginner - mostly because the wrong defaults are easy to stumble into. The good news: AES + GCM is the modern, correct choice for 99% of uses, and the defaults are literally AES in CBC mode, which is fine but not the best.

How it works

Inputs (all the crypto ones are BYTESLIKE - wire in bytes, not strings):

• text - the message to encrypt or decrypt (bytes).
• key - the encryption key (bytes). Get one from Scrypt_Derive or, for a one-off, from SystemRandom.
• iv - the initialization vector / nonce (bytes). This is where SystemRandom comes in. Note the tooltip: it doubles as the tweak for XTS mode.
• algorithm - dropdown: AES, AES128, AES256, Camellia, ChaCha20, TripleDES, SM4, ARC4, Blowfish, CAST5, SEED, IDEA.
• modes - dropdown: CBC, CTR, OFB, CFB, CFB8, GCM, XTS, ECB, None.
• mode - boolean: on = encrypt, off = decrypt.

Optional:

• tag - GCM only. The authentication tag. Mandatory when decrypting GCM, must be None when encrypting.
• min_tag_length - GCM only, default 16.
• nonce - ChaCha20 only; its 12-byte nonce from SystemRandom.

Outputs: output (the ciphertext when encrypting, plaintext when decrypting) and tag (the GCM tag, empty otherwise).

The settings that matter

For a beginner, ignore the dropdown feast and set: algorithm = AES, modes = GCM, key and iv from the pack's nodes. GCM is authenticated encryption - it detects tampering, which CBC can't. If you use GCM, save the tag output; decryption requires it. ECB and None modes have no IV and are weak in ways that even an amateur puzzle should avoid; if you pick them, understand that you're choosing speed over safety.

A note on the "decrepit" algorithms

ARC4, Blowfish, CAST5, SEED, IDEA, and Camellia come from the cryptography library's decrepit module - the maintainers literally call them that. They're supported for legacy compat. If a puzzle asks for Blowfish or IDEA specifically, here you go; otherwise don't reach for them. Also worth knowing: XTS is a disk-encryption mode - using it here is unusual, which the tooltip's "acts like tweak" note hints at.

Installing it

Part of ComfyUI ARG Toolkit - ComfyUI Manager (search "ComfyUI ARG Toolkit") or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI. This node is where the cryptography dependency earns its keep; Manager installs it. No model files.

Common issues

• GCM decrypt fails - you need the exact tag from the encrypt run, wired in, plus the same iv. Miss any and you get an authentication error, which is the cipher working as intended.
• "Must be bytes" - feed strings through a string-to-bytes converter first.
• Everything decrypts to garbage - different key, iv, mode, or algorithm than encryption used. All four must match exactly.
• Wrong key size - AES128 wants a 16-byte key, AES256 a 32-byte one. Scrypt_Derive with length 16 or 32 solves this cleanly.