TLS AEAD ciphers: more bytes for key_block than needed