i think we have to use CBC mode, since CTR will be bytewise-XOR, which
will slow us down a bunch..