def encrypt_key(key, nonce, data):
    """ use "key" and "nonce" to generate a one time key and en-/decrypt
        "data" with the one time key.

        Args
            key: encryption key
            nounce: exactly once used string (try a time-based UUID)
            data: the encrypted data
        Returns
            ciphertext: AES256 encrypted data
    """

    key = clean_string(key)
    key = SHA256d(key).digest()
    nonce_hash = SHA256d(nonce).digest()# assert 32 bytes key
    enc_key = aes(key, nonce_hash)      # generate encryption key
    return aes(enc_key, data)