Method decrypt

nodedb-wal/src/crypto.rs:217–225

Decrypt a payload. Input is ciphertext + auth_tag (16 bytes at end). - `epoch`: must be the epoch that was used during encryption, read from the on-disk segment preamble — **not** `self.epoch`, which reflects the current in-memory lifetime and may differ after a restart. - `lsn`: must match the LSN used during encryption - `header_bytes`: must match the header used during encryption (AAD) - `ciph

(
        &self,
        epoch: &[u8; 4],
        lsn: u64,
        header_bytes: &[u8; HEADER_SIZE],
        ciphertext: &[u8],
    )

    /// - `header_bytes`: must match the header used during encryption (AAD)
    /// - `ciphertext`: the encrypted payload (includes 16-byte auth tag)
    pub fn decrypt(
        &self,
        epoch: &[u8; 4],
        lsn: u64,
        header_bytes: &[u8; HEADER_SIZE],
        ciphertext: &[u8],
    ) -> Result<Vec<u8>> {
        self.decrypt_aad(epoch, lsn, header_bytes, ciphertext)
    }

    /// Decrypt with a caller-provided AAD slice.
    pub fn decrypt_aad(