complete rework, use different iv for every write, works with unencrypted cache
pin saltfile if possible