code: boolean checkChunkMac(byte[] headerNonce, long chunkNumber, ByteBuffer chunkBuf) {
  		assert chunkBuf.remaining() >= NONCE_SIZE + MAC_SIZE;
  
  		// get three components: nonce + payload + mac
  		final ByteBuffer chunkNonceBuf = chunkBuf.asReadOnlyBuffer();
  		chunkNonceBuf.position(0).limit(NONCE_SIZE);
  		final ByteBuffer payloadBuf = chunkBuf.asReadOnlyBuffer();
  		payloadBuf.position(NONCE_SIZE).limit(chunkBuf.limit() - MAC_SIZE);
  		final ByteBuffer expectedMacBuf = chunkBuf.asReadOnlyBuffer();
  		expectedMacBuf.position(chunkBuf.limit() - MAC_SIZE);
  
  		// get nonce:
  		final byte[] chunkNonce = new byte[NONCE_SIZE];
  		chunkNonceBuf.get(chunkNonce);
  
  		// get expected MAC:
  		final byte[] expectedMac = new byte[MAC_SIZE];
  		expectedMacBuf.get(expectedMac);
  
  		// get actual MAC:
  		final byte[] calculatedMac = calcChunkMac(macKey, headerNonce, chunkNumber, chunkNonce, payloadBuf);
  
  		// time-constant equality check of two MACs:
  		return MessageDigest.isEqual(expectedMac, calculatedMac);
  	}
docs: visible for testing