code: public static byte[] decryptBytes (PrivateKey key, byte[] encrypted, byte[] salt)
      {
          try {
              byte[] decrypted = getRSACipher(key).doFinal(encrypted);
              for (int ii = 0; ii < salt.length; ii++) {
                  if (decrypted[decrypted.length - salt.length + ii] != salt[ii]) {
                      return null;
                  }
              }
              byte[] secret = new byte[decrypted.length - salt.length];
              for (int ii = 0; ii < secret.length; ii++) {
                  secret[ii] = decrypted[ii];
              }
              return secret;
          } catch (GeneralSecurityException gse) {
              log.warning("Failed to decrypt bytes", gse);
          }
          return null;
      }
docs: Decrypts a secret key and checks for tailing salt.
  
  @return the secret key, or null on failure or non-matching salt.