Changed encrypted bytes to put tag last

src/Encryption/Codec/EncryptionCodec.cs

@@ -61,8 +61,8 @@ public Task<IReadOnlyCollection<Payload>> DecodeAsync(IReadOnlyCollection<Payloa
 
     private byte[] Encrypt(byte[] data)
     {
-        // Our byte array will have a const-length nonce, const-length tag, and
-        // then the encrypted data. In real-world use, one may want to put nonce
+        // Our byte array will have a const-length nonce, the encrypted data, and
+        // then a const-length tag. In real-world use, one may want to put nonce
         // and/or tag lengths in here.
         var bytes = new byte[NonceSize + TagSize + data.Length];
 
@@ -73,7 +73,7 @@ private byte[] Encrypt(byte[] data)
         // Perform encryption
         using (var aes = new AesGcm(key, TagSize))
         {
-            aes.Encrypt(nonceSpan, data, bytes.AsSpan(NonceSize + TagSize), bytes.AsSpan(NonceSize, TagSize));
+            aes.Encrypt(nonceSpan, data, bytes.AsSpan(NonceSize, data.Length), bytes.AsSpan(NonceSize + data.Length, TagSize));
             return bytes;
         }
     }
@@ -85,7 +85,7 @@ private byte[] Decrypt(byte[] data)
         using (var aes = new AesGcm(key, TagSize))
         {
             aes.Decrypt(
-                data.AsSpan(0, NonceSize), data.AsSpan(NonceSize + TagSize), data.AsSpan(NonceSize, TagSize), bytes.AsSpan());
+                data.AsSpan(0, NonceSize), data.AsSpan(NonceSize, bytes.Length), data.AsSpan(NonceSize + bytes.Length, TagSize), bytes.AsSpan());
             return bytes;
         }
     }