convert to using raw aes128 calls, bcal was a dumb wrapper