default cipher is aes-256-cfb