Broker

Normally, you want to send blobVersion + encrypted data+ iv + macdigest for encrypt output.
Decrypt will get blobVersion first to figure out correct algorithm to use. You check macdigest for (encrypted data+iv) and compare to the received macdigest. If they dont match, it means there is tampering.

After they match, you need to take iv and use it for decrypt.