code: func newDecryptionReader(r *io.SectionReader, f *File) (io.Reader, error) {
  	keyLen := aesKeyLen(f.aesStrength)
  	saltLen := keyLen / 2 // salt is half of key len
  	if saltLen == 0 {
  		return nil, ErrDecryption
  	}
  	// grab the salt and pwvv
  	saltpwvv := make([]byte, saltLen+2)
  	if _, err := r.Read(saltpwvv); err != nil {
  		return nil, err
  	}
  	salt := saltpwvv[:saltLen]
  	pwvv := saltpwvv[saltLen : saltLen+2]
  	// generate keys only if we have a password
  	if f.password == nil {
  		return nil, ErrPassword
  	}
  	decKey, authKey, pwv := generateKeys(f.password(), salt, keyLen)
  	if !checkPasswordVerification(pwv, pwvv) {
  		return nil, ErrPassword
  	}
  	dataOff := int64(saltLen + 2)
  	dataLen := int64(f.CompressedSize64 - uint64(saltLen) - 2 - 10)
  	// // TODO(alex): Should the compressed sizes be fixed?
  	// // Not the ideal place to do this.
  	// f.CompressedSize64 = uint64(dataLen)
  	// f.CompressedSize = uint32(dataLen)
  	data := io.NewSectionReader(r, dataOff, dataLen)
  	authOff := dataOff + dataLen
  	authcode := io.NewSectionReader(r, authOff, 10)
  	ar := newAuthReader(authKey, data, authcode, f.DeferAuth)
  	dr := decryptStream(decKey, ar)
  	if dr == nil {
  		return nil, ErrDecryption
  	}
  	return dr, nil
  }
docs: // newDecryptionReader returns an authenticated, decryption reader