a (ciphertext, mac) tuple
32 bytes encryption key
12 bytes nonce
plain text
additional authentication data. can be empty