separate crypto and filesystem stuff