docs: function (prf, ciphertext, iv, adata, tlen) {
      var out, data = ciphertext.slice(0), tag, w=sjcl.bitArray, l=w.bitLength(data);
      tlen = tlen || 128;
      adata = adata || [];
  
      // Slice tag out of data
      if (tlen <= l) {
        tag = w.bitSlice(data, l-tlen);
        data = w.bitSlice(data, 0, l-tlen);
      } else {
        tag = data;
        data = [];
      }
  
      // decrypt and tag
      out = sjcl.mode.gcm._ctrMode(false, prf, data, adata, iv, tlen);
  
      if (!w.equal(out.tag, tag)) {
        throw new sjcl.exception.corrupt("gcm: tag doesn't match");
      }
      return out.data;
    }