use derived key to encrypt and decrypt data; check password used for backup is same as one used for initialization