use CommonCrypto instead of OpenSSL