code: @SuppressWarnings("PMD.LawOfDemeter")
      public byte[] encrypt(final byte[] payload, final IvParameterSpec initializationVector) {
          final SecretKeySpec encryptionKeySpec = getEncryptionKeySpec();
          try {
              final Cipher cipher = Cipher.getInstance(cipherTransformation);
              cipher.init(ENCRYPT_MODE, encryptionKeySpec, initializationVector);
              return cipher.doFinal(payload);
          } catch (final NoSuchAlgorithmException | NoSuchPaddingException e) {
              // these should not happen as we use an algorithm (AES) and padding (PKCS5) that are guaranteed to exist
              throw new IllegalStateException("Unable to access cipher " + cipherTransformation + ": " + e.getMessage(), e);
          } catch (final InvalidKeyException | InvalidAlgorithmParameterException e) {
              // this should not happen as the key is validated ahead of time and
              // we use an algorithm guaranteed to exist
              throw new IllegalStateException(
                      "Unable to initialise encryption cipher with algorithm " + encryptionKeySpec.getAlgorithm()
                              + " and format " + encryptionKeySpec.getFormat() + ": " + e.getMessage(),
                      e);
          } catch (final IllegalBlockSizeException | BadPaddingException e) {
              // these should not happen as we control the block size and padding
              throw new IllegalStateException("Unable to encrypt data: " + e.getMessage(), e);
          }
      }
docs: Encrypt a payload to embed in a Fernet token
  
  @param payload the raw bytes of the data to store in a token
  @param initializationVector random bytes from a high-entropy source to initialise the AES cipher
  @return the AES-encrypted payload. The length will always be a multiple of 16 (128 bits).
  @see #decrypt(byte[], IvParameterSpec)