code: func Open(out, box []byte, nonce nacl.Nonce, key nacl.Key) ([]byte, bool) {
  	if len(box) < Overhead {
  		return nil, false
  	}
  
  	subKey, counter := nacl.Setup(nonce, key)
  
  	// The Poly1305 key is generated by encrypting 32 bytes of zeros. Since
  	// Salsa20 works with 64-byte blocks, we also generate 32 bytes of
  	// keystream as a side effect.
  	var firstBlock [64]byte
  	salsa.XORKeyStream(firstBlock[:], firstBlock[:], counter, subKey)
  
  	var poly1305Key [32]byte
  	copy(poly1305Key[:], firstBlock[:])
  	var tag [onetimeauth.Size]byte
  	copy(tag[:], box)
  
  	if !onetimeauth.Verify(&tag, box[onetimeauth.Size:], &poly1305Key) {
  		return nil, false
  	}
  
  	ret, out := sliceForAppend(out, len(box)-Overhead)
  
  	// We XOR up to 32 bytes of box with the keystream generated from
  	// the first block.
  	box = box[Overhead:]
  	firstMessageBlock := box
  	if len(firstMessageBlock) > 32 {
  		firstMessageBlock = firstMessageBlock[:32]
  	}
  	for i, x := range firstMessageBlock {
  		out[i] = firstBlock[32+i] ^ x
  	}
  
  	box = box[len(firstMessageBlock):]
  	out = out[len(firstMessageBlock):]
  
  	// Now decrypt the rest.
  	counter[8] = 1
  	salsa.XORKeyStream(out, box, counter, subKey)
  
  	return ret, true
  }
docs: // Open authenticates and decrypts a box produced by Seal and appends the
  // message to out, which must not overlap box. The output will be Overhead
  // bytes smaller than box.