re-refactor to separate pass->key and key->encryption