I agree with Roberto that we should try to not use FOF within core itself. That PLT decision was not only based on FOF being unmaintained at that time.
Fair enough :) I still think it is really important that the AES class should be a JCryptCipher class. I did a basic example of how I think that would work here dongilbert#11 although it wasn't quite up to scratch.
Tracker #
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=33604&start=0