refactor
no hmac yet until verification