//     Output: enc_object_data, metadata
//
//  2. Decrypt:
//     Input: ClientKey, bucket, object, metadata, enc_object_data
//     -          IV <- metadata
//     -   SealedKey <- metadata
//     -   KeyEncKey := HMAC-SHA256(ClientKey, IV || 'SSE-C' || 'DAREv2-HMAC-SHA256' || bucket || '/' || object)
//     -   ObjectKey := DAREv2_Dec(KeyEncKey, SealedKey)
//     - object_data := DAREv2_Dec(ObjectKey, enc_object_data)
//     Output: object_data

	// if C.free is needed).
	func C.CBytes([]byte) unsafe.Pointer

	// C string to Go string
	func C.GoString(*C.char) string

	// C data with explicit length to Go string
	func C.GoStringN(*C.char, C.int) string

	// C data with explicit length to Go []byte
	func C.GoBytes(unsafe.Pointer, C.int) []byte

As a special case, C.malloc does not call the C library malloc directly