auth only when encrypting