def _decrypt(private_key, ciphertext, padding):
if not isinstance(private_key, PrivateKey):<EOL><INDENT>raise TypeError(pretty_message(<EOL>'''<STR_LIT>''',<EOL>type_name(private_key)<EOL>))<EOL><DEDENT>if not isinstance(ciphertext, byte_cls):<EOL><INDENT>raise TypeError(pretty_message(<EOL>'''<STR_LIT>''',<EOL>type_name(ciphertext)<EOL>))<EOL><DEDENT>if not padding:<EOL><INDENT>raise ValueError('<STR_LIT>')<EOL><DEDENT>cf_data = None<EOL>sec_transform = None<EOL>try:<EOL><INDENT>cf_data = CFHelpers.cf_data_from_bytes(ciphertext)<EOL>error_pointer = new(CoreFoundation, '<STR_LIT>')<EOL>sec_transform = Security.SecDecryptTransformCreate(<EOL>private_key.sec_key_ref,<EOL>error_pointer<EOL>)<EOL>handle_cf_error(error_pointer)<EOL>Security.SecTransformSetAttribute(<EOL>sec_transform,<EOL>Security.kSecPaddingKey,<EOL>padding,<EOL>error_pointer<EOL>)<EOL>handle_cf_error(error_pointer)<EOL>Security.SecTransformSetAttribute(<EOL>sec_transform,<EOL>Security.kSecTransformInputAttributeName,<EOL>cf_data,<EOL>error_pointer<EOL>)<EOL>handle_cf_error(error_pointer)<EOL>plaintext = Security.SecTransformExecute(sec_transform, error_pointer)<EOL>handle_cf_error(error_pointer)<EOL>return CFHelpers.cf_data_to_bytes(plaintext)<EOL><DEDENT>finally:<EOL><INDENT>if cf_data:<EOL><INDENT>CoreFoundation.CFRelease(cf_data)<EOL><DEDENT>if sec_transform:<EOL><INDENT>CoreFoundation.CFRelease(sec_transform)<EOL><DEDENT><DEDENT>
Decrypts RSA ciphertext using a private key

:param private_key:
    A PrivateKey object

:param ciphertext:
    The ciphertext - a byte string

:param padding:
    The padding mode to use, specified as a kSecPadding*Key value

:raises:
    ValueError - when any of the parameters contain an invalid value
    TypeError - when any of the parameters are of the wrong type
    OSError - when an error is returned by the OS crypto library

:return:
    A byte string of the plaintext