always call cipher-init so that we can reset IV when caller wants too