decryptEnvelope static method

Future<Uint8List> decryptEnvelope(LrtcEnvelope envelope, Uint8List key)

Decrypts an already-parsed envelope.

The ciphertext is read where it sits — works on read-only asset buffers. One model-sized Dart buffer is allocated for the result; BoringSSL also holds native copies of input and output for the duration of the call, freed deterministically when it returns.

Implementation

static Future<Uint8List> decryptEnvelope(
  LrtcEnvelope envelope,
  Uint8List key,
) async {
  _checkKey(key);
  final encKey = await _deriveKey(key, envelope.label);
  try {
    final aes = await AesGcmSecretKey.importRawKey(encKey);
    return await aes.decryptBytes(
      envelope.sealed,
      envelope.iv,
      additionalData: envelope.header,
      tagLength: _tagBits,
    );
  } on OperationError {
    // BoringSSL refuses the open when the tag does not verify — the GCM
    // equivalent of a MAC failure, checked over header and ciphertext both.
    throw const DecryptionFailedException(
      'Authentication failed — wrong key or tampered data.',
    );
  } finally {
    wipe(encKey);
  }
}