should not check for key null here
key should be at least 16 bytes
changing expected as key changed