decrypt_loop
decrypt_loop(in, NULL, nbytes, s0, nlen, &rolling_mac, key, nr);
decrypt_loop(in, out, nbytes, s0, nlen, NULL, key, nr);