[openssl] we need ECB because we have no IV