length and version fields should be signed and hmaced.
encrypt the field as well.