Explain.
Cleaner API: Return byte[] from encrypt(buf,...)/decrypt(buf,...), which will always copy the input buffer.
Rename encrypt/decrypt to encryptCopy / decryptCopy. It's essential that this is absolutely clear, especially in the ByteBuffer case.
Add test for encrypting/decrypting direct bytebuffers
Fix abuse of ByteBuffer's