add stream-based aes decryption