func (t *Crypto) Decrypt(cipher, aad, nonce []byte, kh interface{}) ([]byte, error) {
	keyHandle, ok := kh.(*keyset.Handle)
	if !ok {
		return nil, errBadKeyHandleFormat
	}
	ps, err := keyHandle.Primitives()
	if err != nil {
		return nil, fmt.Errorf("get primitives: %w", err)
	}
	a, err := aead.New(keyHandle)
	if err != nil {
		return nil, fmt.Errorf("create new aead: %w", err)
	}
	ct := make([]byte, 0, len(ps.Primary.Prefix)+len(nonce)+len(cipher))
	ct = append(ct, ps.Primary.Prefix...)
	ct = append(ct, nonce...)
	ct = append(ct, cipher...)
	pt, err := a.Decrypt(ct, aad)
	if err != nil {
		return nil, fmt.Errorf("decrypt cipher: %w", err)
	}
	return pt, nil
}
Decrypt will decrypt cipher using the implementation's corresponding encryption key referenced by kh of
a private key.
package tinkcrypto
import (
	"errors"
	"fmt"
	"github.com/google/tink/go/aead"
	aeadsubtle "github.com/google/tink/go/aead/subtle"
	"github.com/google/tink/go/core/primitiveset"
	"github.com/google/tink/go/keyset"
	"github.com/google/tink/go/mac"
	"github.com/google/tink/go/signature"
	"golang.org/x/crypto/chacha20poly1305"
	cryptoapi "github.com/hyperledger/aries-framework-go/pkg/crypto"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/aead/subtle"
	"github.com/hyperledger/aries-framework-go/pkg/crypto/tinkcrypto/primitive/bbs"
)
const (
	ECDHESA256KWAlg = "ECDH-ES+A256KW"
	ECDH1PUA128KWAlg = "ECDH-1PU+A128KW"
	ECDH1PUA192KWAlg = "ECDH-1PU+A192KW"
	ECDH1PUA256KWAlg = "ECDH-1PU+A256KW"
	ECDHESXC20PKWAlg = "ECDH-ES+XC20PKW"
	ECDH1PUXC20PKWAlg = "ECDH-1PU+XC20PKW"
	nistPECDHKWPrivateKeyTypeURL  = "type.hyperledger.org/hyperledger.aries.crypto.tink.NistPEcdhKwPrivateKey"
	x25519ECDHKWPrivateKeyTypeURL = "type.hyperledger.org/hyperledger.aries.crypto.tink.X25519EcdhKwPrivateKey"
)
var errBadKeyHandleFormat = errors.New("bad key handle format")
type Crypto struct {
	ecKW  keyWrapper
	okpKW keyWrapper
}
func New() (*Crypto, error) {
	return &Crypto{ecKW: &ecKWSupport{}, okpKW: &okpKWSupport{}}, nil
}
func (t *Crypto) Encrypt(msg, aad []byte, kh interface{}) ([]byte, []byte, error) {
	keyHandle, ok := kh.(*keyset.Handle)
	if !ok {
		return nil, nil, errBadKeyHandleFormat
	}
	ps, err := keyHandle.Primitives()
	if err != nil {
		return nil, nil, fmt.Errorf("get primitives: %w", err)
	}
	a, err := aead.New(keyHandle)
	if err != nil {
		return nil, nil, fmt.Errorf("create new aead: %w", err)
	}
	ct, err := a.Encrypt(msg, aad)
	if err != nil {
		return nil, nil, fmt.Errorf("encrypt msg: %w", err)
	}
	ivSize := nonceSize(ps)
	prefixLength := len(ps.Primary.Prefix)
	cipherText := ct[prefixLength+ivSize:]
	nonce := ct[prefixLength : prefixLength+ivSize]
	return cipherText, nonce, nil
}
func nonceSize(ps *primitiveset.PrimitiveSet) int {
	var ivSize int
	switch ps.Primary.Primitive.(type) {
	case *aeadsubtle.XChaCha20Poly1305:
		ivSize = chacha20poly1305.NonceSizeX
	case *aeadsubtle.AESGCM:
		ivSize = aeadsubtle.AESGCMIVSize
	case *aeadsubtle.EncryptThenAuthenticate:
		ivSize = subtle.AES128Size
	default:
		ivSize = aeadsubtle.AESGCMIVSize
	}
	return ivSize
}