switch to a derived key based encrypted swap