def _encrypt(key_data, derived_key_information):
<EOL>iv = os.urandom(<NUM_LIT:16>)<EOL>symmetric_key = derived_key_information['<STR_LIT>']<EOL>encryptor = Cipher(algorithms.AES(symmetric_key), modes.CTR(iv),<EOL>backend=default_backend()).encryptor()<EOL>ciphertext = encryptor.update(key_data.encode('<STR_LIT:utf-8>')) + encryptor.finalize()<EOL>symmetric_key = derived_key_information['<STR_LIT>']<EOL>salt = derived_key_information['<STR_LIT>']<EOL>hmac_object =cryptography.hazmat.primitives.hmac.HMAC(symmetric_key, hashes.SHA256(),<EOL>backend=default_backend())<EOL>hmac_object.update(ciphertext)<EOL>hmac_value = binascii.hexlify(hmac_object.finalize())<EOL>iterations = derived_key_information['<STR_LIT>']<EOL>return binascii.hexlify(salt).decode() + _ENCRYPTION_DELIMITER +str(iterations) + _ENCRYPTION_DELIMITER +hmac_value.decode() + _ENCRYPTION_DELIMITER +binascii.hexlify(iv).decode() + _ENCRYPTION_DELIMITER +binascii.hexlify(ciphertext).decode()<EOL>
Encrypt 'key_data' using the Advanced Encryption Standard (AES-256) algorithm.
'derived_key_information' should contain a key strengthened by PBKDF2.  The
key size is 256 bits and AES's mode of operation is set to CTR (CounTeR Mode).
The HMAC of the ciphertext is generated to ensure the ciphertext has not been
modified.

'key_data' is the JSON string representation of the key.  In the case
of RSA keys, this format would be 'securesystemslib.formats.RSAKEY_SCHEMA':

{'keytype': 'rsa',
 'keyval': {'public': '-----BEGIN RSA PUBLIC KEY----- ...',
            'private': '-----BEGIN RSA PRIVATE KEY----- ...'}}

'derived_key_information' is a dictionary of the form:
  {'salt': '...',
   'derived_key': '...',
   'iterations': '...'}

'securesystemslib.exceptions.CryptoError' raised if the encryption fails.