Changes

|-

|-

| 3

| 3

| Block Size

| Nonce offset in the output buffer

|-

|-

| 4

| 4

This decrypts the input data with [[PS:EncryptSignDecryptVerifyAesCcm|AES-CCM]] using keytype2, when the input noncesize is <12 the low 2-bits are cleared in the noncesize. The 12-byte nonce buffer used by NS is cleared to all-zero, then the nonce from inputbuf+0 with the noncesize is copied to this nonce buffer. NS then uses [[PS:EncryptSignDecryptVerifyAesCcm]] with keytype2 and with the above nonce buffer, where the inputptr is inputbuf+noncesize, outputptr is outputbuf+0, and size is inputbuffersize - noncesize - 16.

This decrypts the input data with [[PS:EncryptSignDecryptVerifyAesCcm|AES-CCM]] using keytype2, when the input noncesize is <12 the low 2-bits are cleared in the noncesize. The 12-byte nonce buffer used by NS is cleared to all-zero, then the nonce from inputbuf+0 with the noncesize is copied to this nonce buffer. NS then uses [[PS:EncryptSignDecryptVerifyAesCcm]] with keytype2 and with the above nonce buffer, where the inputptr is inputbuf+noncesize, outputptr is outputbuf+0, and size is inputbuffersize - noncesize - 16.

After decryption, NS copies the data at outbuf+blocksize to outbuf+blocksize+noncesize, with size inputbuffersize-blocksize-16. NS then copies the nonce from inputbuf+0 with the noncesize, to outbuf+blocksize.

After decryption, NS copies the data at outbuf+nonceoffset to outbuf+nonceoffset+noncesize, with size inputbuffersize-nonceoffset-16. NS then copies the nonce from inputbuf+0 with the noncesize, to outbuf+nonceoffset.

 

In other words, the data begin from inputbuffer+noncesize is decrypted via [[PS:EncryptSignDecryptVerifyAesCcm]] using the nonce located at the beginning of the input buffer (with the size padded or capped to 12). Then the decrypted data is split into two parts, of which the first one is with size nonceoffset. The nonce is then inserted between the two parts, and written to the output buffer together with decrypted data.