decrypt :: SB.ByteString -- ^ Passphrase
        -> SB.ByteString -- ^ Salt
        -> Int           -- ^ Iteration count
        -> SB.ByteString -- ^ MAC
        -> SB.ByteString -- ^ Ciphertext
        -> Either String SB.ByteString -- ^ Error message or plaintext
decrypt pass salt c mac' txt =
  let (ekey, hkey) = kdf pass salt c
      ctx = AES.initAES ekey
      mac = hmac256 hkey (sha256 salt `SB.append` sha256 txt)
  in if mac' == mac
     then Right (AES.decryptCTR ctx kNONCE txt)
     else Left "MAC mismatch"
decrypt :: SB.ByteString -- ^ Passphrase
        -> SB.ByteString -- ^ Salt
        -> Int           -- ^ Iteration count
        -> SB.ByteString -- ^ MAC
        -> SB.ByteString -- ^ Ciphertext
        -> Either String SB.ByteString
decrypt pass salt c mac' txt =
  let (ekey, hkey) = kdf pass salt c
      ctx = AES.initAES ekey
      mac = hmac256 hkey (sha256 salt `SB.append` sha256 txt)
  in if mac' == mac
     then Right (AES.decryptCTR ctx kNONCE txt)
     else Left "MAC mismatch"
decrypt pass salt c mac' txt =
  let (ekey, hkey) = kdf pass salt c
      ctx = AES.initAES ekey
      mac = hmac256 hkey (sha256 salt `SB.append` sha256 txt)
  in if mac' == mac
     then Right (AES.decryptCTR ctx kNONCE txt)
     else Left "MAC mismatch"