Use

web/packages/base/crypto/ente-impl.ts

@@ -42,7 +42,7 @@ export const _decryptBlobB64 = libsodium.decryptBlobB64;
 
 export const _decryptAssociatedData = libsodium.decryptBlob;
 
-export const _decryptThumbnail = _decryptAssociatedData;
+export const _decryptThumbnail = _decryptBlob;
 
 export const _decryptAssociatedDataB64 = async ({
     encryptedDataB64,

web/packages/base/crypto/ente.ts

@@ -54,7 +54,6 @@ import * as ei from "./ente-impl";
 import type {
     BytesOrB64,
     DecryptBlobB64,
-    DecryptBlobBytes,
     EncryptedBlob_2,
     EncryptedBox2,
     EncryptJSON,
@@ -179,12 +178,10 @@ export const decryptBlobB64 = (blob: EncryptedBlob_2, key: BytesOrB64) =>
         : sharedCryptoWorker().then((w) => w.decryptBlobB64(blob, key));
 
 /**
- * Decrypt the thumbnail for a file.
- *
- * This is the sibling of {@link encryptThumbnail}.
+ * Decrypt the thumbnail encrypted using {@link encryptThumbnail}.
  */
-export const decryptThumbnail = (r: DecryptBlobBytes) =>
-    assertInWorker(ei._decryptThumbnail(r));
+export const decryptThumbnail = (blob: EncryptedBlob_2, key: BytesOrB64) =>
+    assertInWorker(ei._decryptThumbnail(blob, key));
 
 /**
  * Decrypt the metadata JSON associated with an Ente object.

web/packages/new/photos/services/download.ts

@@ -124,11 +124,13 @@ class DownloadManagerImpl {
         const { downloadClient, cryptoWorker } = this.ensureInitialized();
 
         const encrypted = await downloadClient.downloadThumbnail(file);
-        const decrypted = await cryptoWorker.decryptThumbnail({
-            encryptedData: encrypted,
-            decryptionHeaderB64: file.thumbnail.decryptionHeader,
-            keyB64: file.key,
-        });
+        const decrypted = await cryptoWorker.decryptThumbnail(
+            {
+                encryptedData: encrypted,
+                decryptionHeader: file.thumbnail.decryptionHeader,
+            },
+            file.key,
+        );
         return decrypted;
     };