anchor.diff:              append_attr({Attr, {TagV, decode_value(Bin, Type)}}, State);
           {TagV, Encryption} ->
               % for encrypted attributes, tag byte is never part of the value
  -            append_attr({Attr, {TagV, decode_value(decrypt_value(Req, Bin, Encryption), Type)}}, State)
  +            append_attr({Attr, {TagV, decode_value(decrypt_value(Req, State, Bin, Encryption), Type)}}, State)
       end.
   
   -compile({inline, decode_tag_value/1}).
  
positive.code: 
  -spec salt_encrypt(salt(), secret(), authenticator(), binary()) -> binary().
  salt_encrypt(Salt, SharedSecret, RequestAuthenticator, PlainText) ->
      CipherText = do_salt_crypt(Salt, SharedSecret, RequestAuthenticator, (pad_to(16, << (byte_size(PlainText)):8, PlainText/binary >>))),
      <<Salt/binary, CipherText/binary>>.
  
  -spec salt_decrypt(secret(), authenticator(), binary()) -> binary().
  salt_decrypt(SharedSecret, RequestAuthenticator, <<Salt:2/binary, CipherText/binary>>) ->
      << Length:8/integer, PlainText/binary >> = do_salt_crypt(Salt, SharedSecret, RequestAuthenticator, CipherText),
      if
          Length < byte_size(PlainText) ->
              binary:part(PlainText, 0, Length);
  
negative.code: append_attr(Attr, State) ->
      State#decoder_state{attrs = [Attr | State#decoder_state.attrs]}.
  
  -spec decode_attributes(#radius_request{}, binary(), binary()) -> #decoder_state{}.
  decode_attributes(Req, RequestAuthenticator, As) ->
      decode_attributes(Req, As, 0, #decoder_state{request_authenticator = RequestAuthenticator}).
  
  -spec decode_attributes(#radius_request{}, binary(), non_neg_integer(), #decoder_state{}) -> #decoder_state{}.
  decode_attributes(_Req, <<>>, _Pos, State) ->
  