derive session key only when encryption is on