i think I'm seeing a bug in cryptoJS