def _decrypt(message, encryption_data, key_encryption_key=None, resolver=None):
_validate_not_none('<STR_LIT:message>', message)<EOL>content_encryption_key = _validate_and_unwrap_cek(encryption_data, key_encryption_key, resolver)<EOL>if not ( _EncryptionAlgorithm.AES_CBC_256 == encryption_data.encryption_agent.encryption_algorithm):<EOL><INDENT>raise ValueError(_ERROR_UNSUPPORTED_ENCRYPTION_ALGORITHM)<EOL><DEDENT>cipher = _generate_AES_CBC_cipher(content_encryption_key, encryption_data.content_encryption_IV)<EOL>decrypted_data = message<EOL>decryptor = cipher.decryptor()<EOL>decrypted_data = (decryptor.update(decrypted_data) + decryptor.finalize())<EOL>unpadder = PKCS7(<NUM_LIT>).unpadder()<EOL>decrypted_data = (unpadder.update(decrypted_data) + unpadder.finalize())<EOL>return decrypted_data<EOL>
Decrypts the given ciphertext using AES256 in CBC mode with 128 bit padding.
Unwraps the content-encryption-key using the user-provided or resolved key-encryption-key (kek). Returns the original plaintex.

:param str message:
    The ciphertext to be decrypted.
:param _EncryptionData encryption_data:
    The metadata associated with this ciphertext.
:param object key_encryption_key:
    The user-provided key-encryption-key. Must implement the following methods:
    unwrap_key(key, algorithm)--returns the unwrapped form of the specified symmetric key using the string-specified algorithm.
    get_kid()--returns a string key id for this key-encryption-key.
:param function resolver(kid):
    The user-provided key resolver. Uses the kid string to return a key-encryption-key implementing the interface defined above.
:return: The decrypted plaintext.
:rtype: str