move decrypt_lsa to priv as well