implement backchannel encryption/decryption