private ByteSource decryptInternal(byte[] ciphertext, byte[] key, byte[] iv) throws CryptoException {
        if (log.isTraceEnabled()) {
            log.trace("Attempting to decrypt incoming byte array of length " +
                    (ciphertext != null ? ciphertext.length : 0));
        }
        byte[] decrypted = crypt(ciphertext, key, iv, javax.crypto.Cipher.DECRYPT_MODE);
        return decrypted == null ? null : ByteSource.Util.bytes(decrypted);
    }
Returns the transformation string to use with the {@link javax.crypto.Cipher#getInstance} invocation when
creating a new {@code Cipher} instance.  This default implementation always returns
{@link #getAlgorithmName() getAlgorithmName()}.  Block cipher implementations will want to override this method
to support appending cipher operation modes and padding schemes.

@param streaming if the transformation string is going to be used for a Cipher for stream-based encryption or not.
@return the transformation string to use with the {@link javax.crypto.Cipher#getInstance} invocation when
        creating a new {@code Cipher} instance.
src/main/java/org/apache/shiro/crypto/cipher/JcaCipherService.java