def _encrypt_blob(blob, key_encryption_key):
_validate_not_none('<STR_LIT>', blob)<EOL>_validate_not_none('<STR_LIT>', key_encryption_key)<EOL>_validate_key_encryption_key_wrap(key_encryption_key)<EOL>content_encryption_key = urandom(<NUM_LIT:32>)<EOL>initialization_vector = urandom(<NUM_LIT:16>)<EOL>cipher = _generate_AES_CBC_cipher(content_encryption_key, initialization_vector)<EOL>padder = PKCS7(<NUM_LIT>).padder()<EOL>padded_data = padder.update(blob) + padder.finalize()<EOL>encryptor = cipher.encryptor()<EOL>encrypted_data = encryptor.update(padded_data) + encryptor.finalize()<EOL>encryption_data = _generate_encryption_data_dict(key_encryption_key, content_encryption_key,<EOL>initialization_vector)<EOL>encryption_data['<STR_LIT>'] = '<STR_LIT>'<EOL>return dumps(encryption_data), encrypted_data<EOL>
Encrypts the given blob using AES256 in CBC mode with 128 bit padding.
Wraps the generated content-encryption-key using the user-provided key-encryption-key (kek). 
Returns a json-formatted string containing the encryption metadata. This method should
only be used when a blob is small enough for single shot upload. Encrypting larger blobs
is done as a part of the _upload_blob_chunks method.

:param bytes blob:
    The blob to be encrypted.
:param object key_encryption_key:
    The user-provided key-encryption-key. Must implement the following methods:
    wrap_key(key)--wraps the specified key using an algorithm of the user's choice.
    get_key_wrap_algorithm()--returns the algorithm used to wrap the specified symmetric key.
    get_kid()--returns a string key id for this key-encryption-key.
:return: A tuple of json-formatted string containing the encryption metadata and the encrypted blob data.
:rtype: (str, bytes)