on-the-fly decryption