From 51b8c211c270a1994f7a4c1b206bf73f48bcb9ed Mon Sep 17 00:00:00 2001
From: Rick Ross <rick.ross@temporal.io>
Date: Mon, 7 Oct 2024 11:54:04 -0400
Subject: [PATCH] Changed encrypted bytes to put tag last

---
 src/Encryption/Codec/EncryptionCodec.cs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/Encryption/Codec/EncryptionCodec.cs b/src/Encryption/Codec/EncryptionCodec.cs
index f8807c8..62123f7 100644
--- a/src/Encryption/Codec/EncryptionCodec.cs
+++ b/src/Encryption/Codec/EncryptionCodec.cs
@@ -61,8 +61,8 @@ public Task<IReadOnlyCollection<Payload>> DecodeAsync(IReadOnlyCollection<Payloa
 
     private byte[] Encrypt(byte[] data)
     {
-        // Our byte array will have a const-length nonce, const-length tag, and
-        // then the encrypted data. In real-world use, one may want to put nonce
+        // Our byte array will have a const-length nonce, the encrypted data, and
+        // then a const-length tag. In real-world use, one may want to put nonce
         // and/or tag lengths in here.
         var bytes = new byte[NonceSize + TagSize + data.Length];
 
@@ -73,7 +73,7 @@ private byte[] Encrypt(byte[] data)
         // Perform encryption
         using (var aes = new AesGcm(key, TagSize))
         {
-            aes.Encrypt(nonceSpan, data, bytes.AsSpan(NonceSize + TagSize), bytes.AsSpan(NonceSize, TagSize));
+            aes.Encrypt(nonceSpan, data, bytes.AsSpan(NonceSize, data.Length), bytes.AsSpan(NonceSize + data.Length, TagSize));
             return bytes;
         }
     }
@@ -85,7 +85,7 @@ private byte[] Decrypt(byte[] data)
         using (var aes = new AesGcm(key, TagSize))
         {
             aes.Decrypt(
-                data.AsSpan(0, NonceSize), data.AsSpan(NonceSize + TagSize), data.AsSpan(NonceSize, TagSize), bytes.AsSpan());
+                data.AsSpan(0, NonceSize), data.AsSpan(NonceSize, bytes.Length), data.AsSpan(NonceSize + bytes.Length, TagSize), bytes.AsSpan());
             return bytes;
         }
     }