You had one job, Inferno--make it so I didn't have to think about encryption.

InfernoEncryptionProvider.cs

using SecurityDriven.Inferno;
using System;

public class InfernoEncryptionProvider : IEncryptionProvider {
    readonly IEncryptionConfiguration _configuration;

    public InfernoEncryptionProvider(IEncryptionConfiguration configuration) {
        _configuration = configuration;
    }

    public string Decrypt(Encrypted encrypted) {
        if (encrypted == null)
            return null;

        byte[] clearBytes = Decrypt(
            Convert.FromBase64String(encrypted.Value).AsArraySegment(),
            Convert.FromBase64String(encrypted.Salt).AsArraySegment());

        return Utils.SafeUTF8.GetString(clearBytes);
    }

    public Encrypted Encrypt(string clearText) {
        if (string.IsNullOrWhiteSpace(clearText))
            return null;

        var saltBytes = GenerateSalt();
        var cipherBytes = Encrypt(clearText, saltBytes);

        return new Encrypted {
            Value = Convert.ToBase64String(cipherBytes),
            Salt = Convert.ToBase64String(saltBytes)
        };
    }

    private byte[] GenerateSalt() {
        return new CryptoRandom().NextBytes(_configuration.SaltSizeInBytes);
    }

    private byte[] Decrypt(ArraySegment<byte> cipher, ArraySegment<byte> salt) {
        return EtM_CBC.Decrypt(_configuration.MasterKey.ToBytes(),
            cipher, salt);
    }

    private byte[] Encrypt(string clearText, byte[] salt) {
        return EtM_CBC.Encrypt(_configuration.MasterKey.ToBytes(),
            clearText.ToBytes().AsArraySegment(), salt.AsArraySegment());
    }
}