allow subclass to override default encryption/decryption