ipsec: ah_encrypt rework