use CBCEncryption for session key encryption