use an authenticated cipher mode by default