code: ByteBuffer decryptChunk(ByteBuffer ciphertextChunk, SecretKey fileKey) {
  		assert ciphertextChunk.remaining() >= NONCE_SIZE + MAC_SIZE;
  
  		try {
  			// nonce:
  			final byte[] nonce = new byte[NONCE_SIZE];
  			final ByteBuffer chunkNonceBuf = ciphertextChunk.asReadOnlyBuffer();
  			chunkNonceBuf.position(0).limit(NONCE_SIZE);
  			chunkNonceBuf.get(nonce);
  
  			// payload:
  			final ByteBuffer payloadBuf = ciphertextChunk.asReadOnlyBuffer();
  			payloadBuf.position(NONCE_SIZE).limit(ciphertextChunk.limit() - MAC_SIZE);
  
  			// payload:
  			final Cipher cipher = CipherSupplier.AES_CTR.forDecryption(fileKey, new IvParameterSpec(nonce));
  			final ByteBuffer outBuf = ByteBuffer.allocate(cipher.getOutputSize(payloadBuf.remaining()));
  			cipher.doFinal(payloadBuf, outBuf);
  
  			// flip and return:
  			outBuf.flip();
  			return outBuf;
  		} catch (ShortBufferException e) {
  			throw new IllegalStateException("Buffer allocated for reported output size apparently not big enough.", e);
  		} catch (IllegalBlockSizeException | BadPaddingException e) {
  			throw new IllegalStateException("Unexpected exception for CTR ciphers.", e);
  		}
  	}
docs: visible for testing