The AES CTR API was buggy, we need to save the encrypted counter as well