round-trip encrypt/decrypt working