docs: def aes_decrypt(base64_encryption_key, base64_data):
      """Verify HMAC-SHA256 signature and decrypt data with AES-CBC
  
      Arguments:
          encryption_key (str): a base64-encoded string containing an AES encryption key and HMAC
              signing key as generated by generate_encryption_key()
          data (str): a byte string containing the data decrypted with an HMAC signing key
              appended to the end
  
      Returns:
          str: a byte string containing the data that was originally encrypted
  
      Raises:
          AuthenticationError: when the HMAC-SHA256 signature authentication fails
  
      """
      data = from_base64(base64_data)
      aes_key_bytes, hmac_key_bytes = _extract_keys(base64_encryption_key)
      data, hmac_signature = data[:-HMAC_SIG_SIZE], data[-HMAC_SIG_SIZE:]
      if hmac.new(hmac_key_bytes, data, hashlib.sha256).digest() != hmac_signature:
          raise AuthenticationError("HMAC authentication failed")
      iv_bytes, data = data[:AES_BLOCK_SIZE], data[AES_BLOCK_SIZE:]
      cipher = AES.new(aes_key_bytes, AES.MODE_CBC, iv_bytes)
      data = cipher.decrypt(data)
      return _unpad(data)