mac key should be first half of content encryption key