def decrypt(data, nonce, additional_data = '')
      valid?(data, nonce, additional_data)

      new_data = crypt(data.b[0...-@mac_len], nonce)
      new_mac = mac(new_data, nonce, additional_data)
      return new_data if new_mac == data.b[-@mac_len..-1]
      ''
    end
def decrypt(data, nonce, additional_data = '')
      valid?(data, nonce, additional_data)

      new_data = crypt(data.b[0...-@mac_len], nonce)
      new_mac = mac(new_data, nonce, additional_data)
      return new_data if new_mac == data.b[-@mac_len..-1]
      ''
    end
Decrypts the input data and checks the appended mac.
 If additional data was used for encryption, its needed
 for decryption, to check the authentication (mac).

 @param data [String] the data to decrypt
 @param nonce [String] the nonce used for decryption
 @param additional_data [String] additional data to check
        authentication (not part of the output)

 @return [String] the decrypted data without mac