public function encrypt($message, $userPublicKey, $userAuthToken, $regenerateKeys = false)
    {
        if (self::MAX_MESSAGE_LENGTH < strlen($message)) {
            throw new \RuntimeException(sprintf(
                'Length of message must not be greater than %d octets.', self::MAX_MESSAGE_LENGTH
            ));
        }

        // pad the message
        $message = self::padMessage($message);

        if ($regenerateKeys) {
            $this->initialize();
        }

        $userPublicKey = Base64Url::decode($userPublicKey);
        $userAuthToken = Base64Url::decode($userAuthToken);

        // get the shared secret
        $sharedSecret = $this->getSharedSecret($userPublicKey);

        $ikm = !empty($userAuthToken) ?
            self::hkdf($userAuthToken, $sharedSecret, 'Content-Encoding: auth'.chr(0), 32) :
            $sharedSecret;

        $context = $this->createContext($userPublicKey);

        // derive the Content Encryption Key
        $contentEncryptionKey = self::hkdf($this->salt, $ikm, self::createInfo('aesgcm', $context), 16);

        // derive the nonce
        $nonce = self::hkdf($this->salt, $ikm, self::createInfo('nonce', $context), 12);

        if (version_compare(PHP_VERSION, '7.1') >= 0) {
            $encryptedText = openssl_encrypt($message, 'aes-128-gcm', $contentEncryptionKey, OPENSSL_RAW_DATA, $nonce, $tag);
        } else {
            list($encryptedText, $tag) = \AESGCM\AESGCM::encrypt($contentEncryptionKey, $nonce, $message, '');
        }

        return $encryptedText.$tag;
    }