api that tries to avoid wrapping attacks

also a test