Given ciphertext previously generated by Encrypt and the key and associated data that were used when generating the ciphertext, return the original plaintext given to Encrypt.

Given a key and plaintext, encrypt the plaintext using the SIV mode of AES, as defined by RFC 5297, append the result (including both the synthetic initialization vector and the ciphertext) to dst, and return the updated slice.

*NotAuthenticError is returned by Decrypt if the input is otherwise well-formed but the ciphertext doesn't check out as authentic.