fix some performance problem: only decrypt once when validating