So I tried to follow the instructions at http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html (written by HN's cperciva) and wrote https://github.com/andrewcooke/simple-crypt

Is that OK? Given the problems Tarsnap had with CTR mode, was it wrong to follow those instructions anyway? Have I got the offset handling right?

It seemed like it would be better to write this once, get it revised here, and then publish it (I'll make an egg for pypi once it seems OK) than quietly write my own and let others do the same (it was surprisingly complex - I mention the Tarsnap issues because after reading about them realised I had the same error...).

Apologies if I overlooked an existing package. And thanks for any constructive criticism.