add cbc-mac on ciphertext