def _decrypt(file_contents, password):
<EOL>try:<EOL><INDENT>salt, iterations, hmac, iv, ciphertext =file_contents.split(_ENCRYPTION_DELIMITER)<EOL><DEDENT>except ValueError:<EOL><INDENT>raise securesystemslib.exceptions.CryptoError('<STR_LIT>')<EOL><DEDENT>salt = binascii.unhexlify(salt.encode('<STR_LIT:utf-8>'))<EOL>iterations = int(iterations)<EOL>iv = binascii.unhexlify(iv.encode('<STR_LIT:utf-8>'))<EOL>ciphertext = binascii.unhexlify(ciphertext.encode('<STR_LIT:utf-8>'))<EOL>junk_old_salt, junk_old_iterations, symmetric_key =_generate_derived_key(password, salt, iterations)<EOL>generated_hmac_object =cryptography.hazmat.primitives.hmac.HMAC(symmetric_key, hashes.SHA256(),<EOL>backend=default_backend())<EOL>generated_hmac_object.update(ciphertext)<EOL>generated_hmac = binascii.hexlify(generated_hmac_object.finalize())<EOL>if not securesystemslib.util.digests_are_equal(generated_hmac.decode(), hmac):<EOL><INDENT>raise securesystemslib.exceptions.CryptoError('<STR_LIT>')<EOL><DEDENT>decryptor = Cipher(algorithms.AES(symmetric_key), modes.CTR(iv),<EOL>backend=default_backend()).decryptor()<EOL>plaintext = decryptor.update(ciphertext) + decryptor.finalize()<EOL>return plaintext<EOL>
The corresponding decryption routine for _encrypt().

'securesystemslib.exceptions.CryptoError' raised if the decryption fails.