seems to me that we have aes wrap and it would be a smop to add crypt-and-mac to give the user the choice. we can open a low priority ticket for the latter if you really care, or have code we can just use in the arm side. randy