Update return type of DECRYPT / RSA_DECRYPT

Related to firebird#6797

src/docs/asciidoc/en/refdocs/fblangref40/_fblangref40-functions-scalar.adoc

@@ -3702,8 +3702,7 @@ A plain `AVG(Weight)` would include the -1 weights, thus skewing the result.
 DSQL, PSQL
 
 .Result type
-// TODO See https://github.com/FirebirdSQL/firebird/issues/6797
-`VARCHAR` or `BLOB`
+`VARBINARY` or `BLOB`
 
 .Syntax
 [listing,subs=+quotes]
@@ -3767,13 +3766,13 @@ only for `CHACHA20`.
 Default is `0`.
 |===
 
-`DECRYPT` can decrypt data using a symmetric cipher.
+`DECRYPT` decrypts data using a symmetric cipher.
 
 [NOTE]
 ====
 * Sizes of data strings (like _encrypted_input_, _key_ and _iv_) must meet the requirements of the selected algorithm and mode.
-* This function returns `BLOB SUB_TYPE BINARY` when the first argument is a `BLOB`, and `VARCHAR CHARACTER SET NONE` for all other text and binary types.
-// TODO This last thing might be a bug, see https://github.com/FirebirdSQL/firebird/issues/6797
+* This function returns `BLOB SUB_TYPE BINARY` when the first argument is a `BLOB`, and `VARBINARY` for all other text and binary types.
+* When the encrypted data was text, it must be explicitly cast to a string type of appropriate character set.
 * The ins and outs of the various algorithms are considered beyond the scope of this language reference.
 We recommend searching the internet for further details on the algorithms.
 ====
@@ -3836,6 +3835,8 @@ ENCRYPT ( _input_
 We recommend searching the internet for further details on the algorithms.
 ====
 
+// TODO Document algorithm requirement (sizes etc)
+
 [[fblangref40-scalarfuncs-encrypt-exmpl]]
 ==== `ENCRYPT` Examples
 
@@ -3855,8 +3856,7 @@ select encrypt('897897' using sober128 key 'AbcdAbcdAbcdAbcd' iv '01234567')
 DSQL, PSQL
 
 .Result type
-// TODO See https://github.com/FirebirdSQL/firebird/issues/6797
-`VARCHAR`
+`VARBINARY`
 
 .Syntax
 [listing,subs=+quotes]
@@ -3892,6 +3892,12 @@ default is `SHA256`.
 
 `RSA_DECRYPT` decrypts _encrypted_input_ using the RSA private key and then OAEP de-pads the resulting data.
 
+[NOTE]
+====
+* This function returns VARBINARY`.
+* When the encrypted data was text, it must be explicitly cast to a string type of appropriate character set.
+====
+
 [[fblangref40-scalarfuncs-rsadecrypt-exmpl]]
 ==== `RSA_DECRYPT` Examples
 
@@ -3902,8 +3908,9 @@ Run the examples of the <<fblangref40-scalarfuncs-rsaprivate-exmpl,`RSA_PRIVATE`
 
 [source]
 ----
-select rsa_decrypt(rdb$get_context('USER_SESSION', 'msg')
-  key rdb$get_context('USER_SESSION', 'private_key')) from rdb$database;
+select cast(rsa_decrypt(rdb$get_context('USER_SESSION', 'msg')
+  key rdb$get_context('USER_SESSION', 'private_key')) as varchar(128))
+from rdb$database;
 ----
 
 .See also