return cipher from handshake