avoid copy on write, in decrypt