checkpoint - start decrypt