upgrade to aes-256-ctr and normalize to sha256 before the aes key for opens
generate two different aes keys combining the ecdhe shared secret and line ids uniquely