anchor.diff:               encrypt_ctx = IV0} = Ssh,
           <<LenData:4/binary, PayloadData/binary>>) when SshCipher == 'AEAD_AES_128_GCM' ;
                                                          SshCipher == 'AEAD_AES_256_GCM' ->
  -    {Ctext,Ctag} = crypto:block_encrypt(CryptoCipher, K, IV0, {LenData,PayloadData}),
  +    {Ctext,Ctag} = crypto:crypto_one_time_aead(CryptoCipher, K, IV0, PayloadData, LenData, true),
       IV = next_gcm_iv(IV0),
       {Ssh#ssh{encrypt_ctx = IV}, {<<LenData/binary,Ctext/binary>>,Ctag}};
   
   encrypt(#ssh{encrypt_ctx = Ctx0} = Ssh, Data) ->
       Enc = crypto:crypto_update(Ctx0, Data),
       {Ssh, Enc}.
  -  
  +
   %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
   %% Decryption
   %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
  
positive.code:     {Ssh, <<>>};
  
  decrypt(#ssh{decrypt = 'chacha20-poly1305@openssh.com',
               decrypt_keys = {K1,_K2},
               recv_sequence = Seq} = Ssh, {length,EncryptedLen}) ->
      PacketLenBin = crypto:crypto_one_time(chacha20, K1, <<0:8/unit:8, Seq:8/unit:8>>, EncryptedLen, false),
      {Ssh, PacketLenBin};
  
  decrypt(#ssh{decrypt = 'chacha20-poly1305@openssh.com',
               decrypt_keys = {_K1,K2},
               recv_sequence = Seq} = Ssh, {AAD,Ctext,Ctag}) ->
      %% The length is already decoded and used to divide the input
      %% Check the mac (important that it is timing-safe):
      PolyKey = crypto:crypto_one_time(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>, <<0:32/unit:8>>, false),
      case equal_const_time(Ctag, crypto:poly1305(PolyKey, <<AAD/binary,Ctext/binary>>)) of
          true ->
              %% MAC is ok, decode
              IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
              PlainText = crypto:crypto_one_time(chacha20, K2, IV2, Ctext, false),
              {Ssh, PlainText};
          false ->
             {Ssh,error}
      end;
  
  decrypt(#ssh{decrypt = none} = Ssh, Data) ->
  
negative.code: decrypt(#ssh{decrypt = SshCipher,
               decrypt_cipher = CryptoCipher,
  	     decrypt_keys = K,
  	     decrypt_ctx = IV0} = Ssh, {AAD,Ctext,Ctag}) when SshCipher == 'AEAD_AES_128_GCM' ;
                                                                SshCipher == 'AEAD_AES_256_GCM' ->
      Dec = crypto:crypto_one_time_aead(CryptoCipher, K, IV0, Ctext, AAD, Ctag, false),
      IV = next_gcm_iv(IV0),
      {Ssh#ssh{decrypt_ctx = IV}, Dec};
  
  