iv should be different from password