use kdf to generate key for encryption