move decrypt_lsa and decrypt_secret to priv too