code: ByteBuffer encryptChunk(ByteBuffer cleartextChunk, long chunkNumber, byte[] headerNonce, SecretKey fileKey) {
  		try {
  			// nonce:
  			byte[] nonce = new byte[NONCE_SIZE];
  			random.nextBytes(nonce);
  
  			// payload:
  			final Cipher cipher = CipherSupplier.AES_CTR.forEncryption(fileKey, new IvParameterSpec(nonce));
  			final ByteBuffer outBuf = ByteBuffer.allocate(NONCE_SIZE + cipher.getOutputSize(cleartextChunk.remaining()) + MAC_SIZE);
  			outBuf.put(nonce);
  			int bytesEncrypted = cipher.doFinal(cleartextChunk, outBuf);
  
  			// mac:
  			final ByteBuffer ciphertextBuf = outBuf.asReadOnlyBuffer();
  			ciphertextBuf.position(NONCE_SIZE).limit(NONCE_SIZE + bytesEncrypted);
  			byte[] authenticationCode = calcChunkMac(macKey, headerNonce, chunkNumber, nonce, ciphertextBuf);
  			assert authenticationCode.length == MAC_SIZE;
  			outBuf.put(authenticationCode);
  
  			// flip and return:
  			outBuf.flip();
  			return outBuf;
  		} catch (ShortBufferException e) {
  			throw new IllegalStateException("Buffer allocated for reported output size apparently not big enough.", e);
  		} catch (IllegalBlockSizeException | BadPaddingException e) {
  			throw new IllegalStateException("Unexpected exception for CTR ciphers.", e);
  		}
  	}
docs: visible for testing