anchor.diff:                   decrypt_block_size = BlockBytes,
                    decrypt_ctx = Ctx0}}.
   
  +
   decrypt_final(Ssh) ->
       {ok, Ssh#ssh {decrypt = none, 
   		  decrypt_keys = undefined,
  
positive.code: decrypt(#ssh{decrypt = SshCipher,
               decrypt_cipher = CryptoCipher,
  	     decrypt_keys = K,
  	     decrypt_ctx = IV0} = Ssh, Data = {_AAD,_Ctext,_Ctag}) when SshCipher == 'AEAD_AES_128_GCM' ;
                                                                          SshCipher == 'AEAD_AES_256_GCM' ->
      Dec = crypto:block_decrypt(CryptoCipher, K, IV0, Data), % Dec = PlainText | error
      IV = next_gcm_iv(IV0),
      {Ssh#ssh{decrypt_ctx = IV}, Dec};
  
  
negative.code:     {Ssh, <<>>};
  
  decrypt(#ssh{decrypt = 'chacha20-poly1305@openssh.com',
               decrypt_keys = {K1,K2},
               recv_sequence = Seq} = Ssh, Data) ->
      case Data of
          {length,EncryptedLen} ->
              %% The length is decrypted separately in a first step
              PacketLenBin = crypto:crypto_one_time(chacha20, K1, <<0:8/unit:8, Seq:8/unit:8>>, EncryptedLen, false),
              {Ssh, PacketLenBin};
           {AAD,Ctext,Ctag} ->
              %% The length is already decrypted and used to divide the input
              %% Check the mac (important that it is timing-safe):
              PolyKey = crypto:crypto_one_time(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>, <<0:32/unit:8>>, false),
              case equal_const_time(Ctag, crypto:poly1305(PolyKey, <<AAD/binary,Ctext/binary>>)) of
                  true ->
                      %% MAC is ok, decode
                      IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
                      PlainText = crypto:crypto_one_time(chacha20, K2, IV2, Ctext, false),
                      {Ssh, PlainText};
                  false ->
                      {Ssh,error}
              end
      end;
  
  decrypt(#ssh{decrypt = none} = Ssh, Data) ->
  