checkpoint - encrypt