Remove encryptEasy and decryptEasy; both functions are insecure and only serve to confuse possible users.

Your padding implementation is incorrect if the data already contains null bytes (Use PKCS#7).

Encrypt-then-MAC is recommended, since your current implementation is theoretically vulnerable to CTR bitflipping attacks.

Instead of using a reference param for exceptions, just throw exceptions directly.

Remove encryptEasy and decryptEasy; both functions are insecure and only serve to confuse possible users.

Your current scheme doesn't use a MAC, not a checksum which means the ciphertext is unauthenticated. This is a bad idea. It is recommended to use a HMAC function for authentication, in order to also avoid the risk of hash extension attacks while keeping the output range large.

Encrypt-then-MAC is recommended, while your current approach is hash-then-encrypt which is theoretically vulnerable to CTR bitflipping attacks.

Your padding implementation is incorrect if the data already contains null bytes (Use PKCS#7).

Instead of using a reference param for exceptions, just throw exceptions directly.