diff --git a/.travis.yml b/.travis.yml
index 5080b8b..64f6935 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -14,4 +14,4 @@
 script:
   - diff -u <(echo -n) <(gofmt -d $(git ls-files | grep '.go$' | grep -v vendor))
   - go vet $(glide novendor)
-  - go test $(glide novendor)
+  - go test -covermode=atomic $(glide novendor)
diff --git a/cipher/cipher.go b/cipher/cipher.go
new file mode 100644
index 0000000..06d8242
--- /dev/null
+++ b/cipher/cipher.go
@@ -0,0 +1,186 @@
+// Copyright 2017 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package cipher
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"fmt"
+	"sync"
+)
+
+type Mode string
+type Padding string
+
+const (
+	ModeEcb = Mode("ECB")
+)
+
+const (
+	PaddingPKCS7 = Padding("PKCS7Padding")
+	PaddingPKCS5 = Padding("PKCS5Padding")
+)
+
+var (
+	supportedModes = map[Mode]bool{
+		ModeEcb: true,
+	}
+	supportedPadding = map[Padding]bool{
+		PaddingPKCS7: true,
+		PaddingPKCS5: true,
+	}
+)
+
+func (p Padding) padding(input []byte) (output []byte) {
+	switch p {
+	case PaddingPKCS5:
+		fallthrough
+	case PaddingPKCS7:
+		//PKCS7Padding
+		numPad := 16 - (len(input) % 16)
+		output = make([]byte, len(input)+numPad)
+		for i := copy(output, []byte(input)); i < len(output); i++ {
+			output[i] = byte(numPad)
+		}
+	}
+	return
+}
+
+func (p Padding) strip(input []byte) (output []byte) {
+	switch p {
+	case PaddingPKCS5:
+		fallthrough
+	case PaddingPKCS7:
+		//remove PKCS7Padding
+		numPad := int(input[len(input)-1])
+		output = input[:(len(input) - numPad)]
+	}
+	return
+}
+
+// Create a new AesCipher object with the specified encryption mode and padding algorithm.
+func CreateAesCipher(key []byte) (*AesCipher, error) {
+	a := &AesCipher{
+		mutex: &sync.RWMutex{},
+	}
+	if err := a.SetKey(key); err != nil {
+		return nil, err
+	}
+	return a, nil
+}
+
+// An object to perform AES encryption/decryption.
+type AesCipher struct {
+	key   []byte
+	block cipher.Block
+	mutex *sync.RWMutex
+}
+
+// Set/Change the AES key, accepted key's bit-size is 128/192/256.
+func (a *AesCipher) SetKey(key []byte) (err error) {
+	a.mutex.Lock()
+	defer a.mutex.Unlock()
+	a.key = key
+	a.block, err = aes.NewCipher(key)
+	return err
+}
+
+// Encrypt the plaintext. Padding is performed before encryption, so the
+// plaintext input can have any length.
+func (a *AesCipher) Encrypt(plaintext []byte, mode Mode, padding Padding) (ciphertext []byte, err error) {
+	// check mode
+	if !supportedModes[mode] {
+		return nil, &ErrModeUnsupported{
+			mode: mode,
+		}
+	}
+	// check padding
+	if !supportedPadding[padding] {
+		return nil, &ErrPaddingUnsupported{
+			padding: padding,
+		}
+	}
+	// padding
+	text := padding.padding(plaintext)
+	ciphertext = text
+
+	// encrypt
+	a.mutex.RLock()
+	block := a.block
+	a.mutex.RUnlock()
+
+	switch mode {
+	case ModeEcb:
+		size := block.BlockSize()
+		for len(text) > 0 {
+			block.Encrypt(text, text)
+			text = text[size:]
+		}
+	}
+	return
+}
+
+// Decrypt the ciphertext. Padding is removed after decryption, so the
+// plaintext output can have different length from input ciphertext.
+func (a *AesCipher) Decrypt(ciphertext []byte, mode Mode, padding Padding) (plaintext []byte, err error) {
+	// check mode
+	if !supportedModes[mode] {
+		return nil, &ErrModeUnsupported{
+			mode: mode,
+		}
+	}
+	// check padding
+	if !supportedPadding[padding] {
+		return nil, &ErrPaddingUnsupported{
+			padding: padding,
+		}
+	}
+
+	// encrypt
+	a.mutex.RLock()
+	block := a.block
+	a.mutex.RUnlock()
+
+	switch mode {
+	case ModeEcb:
+		plaintext = make([]byte, len(ciphertext))
+		buffer := plaintext
+		size := block.BlockSize()
+		for len(ciphertext) > 0 {
+			block.Decrypt(buffer, ciphertext)
+			ciphertext = ciphertext[size:]
+			buffer = buffer[size:]
+		}
+	}
+
+	// strip padding
+	plaintext = padding.strip(plaintext)
+	return
+}
+
+type ErrModeUnsupported struct {
+	mode Mode
+}
+
+func (e *ErrModeUnsupported) Error() string {
+	return fmt.Sprintf("mode unsupported: %v", e.mode)
+}
+
+type ErrPaddingUnsupported struct {
+	padding Padding
+}
+
+func (e *ErrPaddingUnsupported) Error() string {
+	return fmt.Sprintf("padding unsupported: %v", e.padding)
+}
diff --git a/cipher/cipher_test.go b/cipher/cipher_test.go
new file mode 100644
index 0000000..0bdde75
--- /dev/null
+++ b/cipher/cipher_test.go
@@ -0,0 +1,118 @@
+// Copyright 2017 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cipher_test
+
+import (
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+
+	"github.com/apid/apid-core/cipher"
+	"testing"
+)
+
+func TestEvents(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Cipher Suite")
+}
+
+var _ = Describe("APID Cipher", func() {
+
+	Context("AES", func() {
+
+		Context("AES/ECB/PKCS7Padding Encrypt/Decrypt", func() {
+			type testData struct {
+				key        []byte
+				plaintext  []byte
+				ciphertext []byte
+			}
+
+			data := []testData{
+				{
+					// 128-bit
+					[]byte{2, 122, 212, 83, 150, 164, 180, 4, 148, 242, 65, 189, 3, 188, 76, 247},
+					[]byte("aUWQKgAwmaR0p2kY"),
+					// 32-byte after padding
+					[]byte{218, 53, 247, 87, 119, 80, 231, 16, 125, 11, 214, 101, 246, 202, 178, 163, 202, 102,
+						146, 245, 79, 215, 74, 228, 17, 83, 213, 134, 105, 203, 31, 14},
+				},
+				{
+					// 192-bit
+					[]byte{2, 122, 212, 83, 150, 164, 180, 4, 148, 242, 65, 189, 3, 188, 76, 247,
+						2, 122, 212, 83, 150, 164, 180, 4},
+					[]byte("a"),
+					// 16-byte after padding
+					[]byte{225, 2, 177, 65, 152, 88, 116, 43, 71, 215, 84, 240, 221, 175, 11, 131},
+				},
+				{
+					// 256-bit
+					[]byte{2, 122, 212, 83, 150, 164, 180, 4, 148, 242, 65, 189, 3, 188, 76, 247,
+						2, 122, 212, 83, 150, 164, 180, 4, 148, 242, 65, 189, 3, 188, 76, 247},
+					[]byte(""),
+					// 16-byte after padding
+					[]byte{88, 192, 164, 235, 153, 89, 14, 134, 224, 122, 31, 36, 238, 117, 121, 117},
+				},
+			}
+			It("Encrypt", func() {
+				for i := 0; i < len(data); i++ {
+					c, err := cipher.CreateAesCipher(data[i].key)
+					Expect(err).Should(Succeed())
+					Expect(c.Encrypt(data[i].plaintext, cipher.ModeEcb, cipher.PaddingPKCS5)).Should(Equal(data[i].ciphertext))
+					Expect(c.Encrypt(data[i].plaintext, cipher.ModeEcb, cipher.PaddingPKCS7)).Should(Equal(data[i].ciphertext))
+				}
+			})
+
+			It("Decrypt", func() {
+				for i := 0; i < len(data); i++ {
+					c, err := cipher.CreateAesCipher(data[i].key)
+					Expect(err).Should(Succeed())
+					Expect(c.Encrypt(data[i].plaintext, cipher.ModeEcb, cipher.PaddingPKCS5)).Should(Equal(data[i].ciphertext))
+					Expect(c.Encrypt(data[i].plaintext, cipher.ModeEcb, cipher.PaddingPKCS7)).Should(Equal(data[i].ciphertext))
+				}
+			})
+		})
+
+		It("SetKey", func() {
+			key := make([]byte, 16)
+			plaintext := []byte("aUWQKgAwmaR0p2kY")
+			ciphertext := []byte{218, 53, 247, 87, 119, 80, 231, 16, 125, 11, 214, 101, 246, 202, 178, 163, 202, 102, 146, 245, 79, 215, 74, 228, 17, 83, 213, 134, 105, 203, 31, 14}
+			c, err := cipher.CreateAesCipher(key)
+			Expect(err).Should(Succeed())
+			key = []byte{2, 122, 212, 83, 150, 164, 180, 4, 148, 242, 65, 189, 3, 188, 76, 247}
+			Expect(c.SetKey(key)).Should(Succeed())
+			Expect(c.Encrypt(plaintext, cipher.ModeEcb, cipher.PaddingPKCS5)).Should(Equal(ciphertext))
+			Expect(c.Decrypt(ciphertext, cipher.ModeEcb, cipher.PaddingPKCS7)).Should(Equal(plaintext))
+		})
+
+		It("Invalid Parameters", func() {
+			_, err := cipher.CreateAesCipher(make([]byte, 15))
+			Expect(err).ToNot(Succeed())
+			_, err = cipher.CreateAesCipher(nil)
+			Expect(err).ToNot(Succeed())
+			key := make([]byte, 16)
+			c, err := cipher.CreateAesCipher(key)
+			Expect(err).Should(Succeed())
+			_, err = c.Encrypt([]byte{1, 2, 3}, cipher.Mode("unsupported"), cipher.PaddingPKCS7)
+			Expect(err).ToNot(Succeed())
+			_, err = c.Encrypt([]byte{1, 2, 3}, cipher.ModeEcb, cipher.Padding("unsupported"))
+			Expect(err).ToNot(Succeed())
+			_, err = c.Decrypt([]byte{88, 192, 164, 235, 153, 89, 14, 134, 224, 122, 31, 36, 238, 117, 121, 117},
+				cipher.Mode("unsupported"), cipher.PaddingPKCS7)
+			Expect(err).ToNot(Succeed())
+			_, err = c.Decrypt([]byte{88, 192, 164, 235, 153, 89, 14, 134, 224, 122, 31, 36, 238, 117, 121, 117},
+				cipher.ModeEcb, cipher.Padding("unsupported"))
+			Expect(err).ToNot(Succeed())
+		})
+	})
+})