docs: public static void decrypt(File file,
                               String keyBase64,
                               String ivBase64,
                               RemoteStoreFileEncryptionMaterial encMat)
    throws NoSuchAlgorithmException,
           NoSuchPaddingException,
           InvalidKeyException,
           IllegalBlockSizeException,
           BadPaddingException,
           InvalidAlgorithmParameterException,
           IOException
    {
      byte[] keyBytes = Base64.decode(keyBase64);
      byte[] ivBytes = Base64.decode(ivBase64);
      byte[] qsmkBytes = Base64.decode(encMat.getQueryStageMasterKey());
      final SecretKey fileKey;
  
      // Decrypt file key
      {
        final Cipher keyCipher = Cipher.getInstance(KEY_CIPHER);
        SecretKey queryStageMasterKey =
            new SecretKeySpec(qsmkBytes, 0, qsmkBytes.length, AES);
        keyCipher.init(Cipher.DECRYPT_MODE, queryStageMasterKey);
        byte[] fileKeyBytes = keyCipher.doFinal(keyBytes);
  
        // NB: we assume qsmk.length == fileKey.length
        //     (fileKeyBytes.length may be bigger due to padding)
        fileKey = new SecretKeySpec(fileKeyBytes, 0, qsmkBytes.length, AES);
      }
  
      // Decrypt file
      {
        final Cipher fileCipher = Cipher.getInstance(FILE_CIPHER);
        final IvParameterSpec iv = new IvParameterSpec(ivBytes);
        final byte[] buffer = new byte[BUFFER_SIZE];
        fileCipher.init(Cipher.DECRYPT_MODE, fileKey, iv);
  
        long totalBytesRead = 0;
        // Overwrite file contents buffer-wise with decrypted data
        try (InputStream is = Files.newInputStream(file.toPath(), READ);
             InputStream cis = new CipherInputStream(is, fileCipher);
             OutputStream os = Files.newOutputStream(file.toPath(), CREATE);)
        {
          int bytesRead;
          while ((bytesRead = cis.read(buffer)) > -1)
          {
            os.write(buffer, 0, bytesRead);
            totalBytesRead += bytesRead;
          }
        }
  
        // Discard any padding that the encrypted file had
        try (FileChannel fc = new FileOutputStream(file, true).getChannel())
        {
          fc.truncate(totalBytesRead);
        }
      }
    }