diff --git a/libindy/src/commands/crypto.rs b/libindy/src/commands/crypto.rs
index f68497a456..bd9bf4c175 100644
--- a/libindy/src/commands/crypto.rs
+++ b/libindy/src/commands/crypto.rs
@@ -381,17 +381,20 @@ impl CryptoCommandExecutor {
             )));
         }
 
-        let (base64_protected, cek) = if let Some(sender_vk) = sender_vk {
+        //generate content encryption key that will encrypt `message`
+        let cek = chacha20poly1305_ietf::gen_key();
+
+        let base64_protected = if let Some(sender_vk) = sender_vk {
             self.crypto_service.validate_key(&sender_vk)?;
 
             //returns authcrypted pack_message format. See Wire message format HIPE for details
-            self._prepare_protected_authcrypt(receiver_list, &sender_vk, wallet_handle)?
+            self._prepare_protected_authcrypt(&cek, receiver_list, &sender_vk, wallet_handle)?
         } else {
             //returns anoncrypted pack_message format. See Wire message format HIPE for details
-            self._prepare_protected_anoncrypt(receiver_list)?
+            self._prepare_protected_anoncrypt(&cek, receiver_list)?
         };
 
-        // encrypt ciphertext and integrity protect "protected" field
+        // Use AEAD to encrypt `message` with "protected" data as "associated data"
         let (ciphertext, iv, tag) =
             self.crypto_service
                 .encrypt_plaintext(message, &base64_protected, &cek);
@@ -400,12 +403,11 @@ impl CryptoCommandExecutor {
     }
 
     fn _prepare_protected_anoncrypt(&self,
+                                    cek: &chacha20poly1305_ietf::Key,
                                     receiver_list: Vec<String>,
-    ) -> IndyResult<(String, chacha20poly1305_ietf::Key)> {
+    ) -> IndyResult<String> {
         let mut encrypted_recipients_struct : Vec<Recipient> = vec![];
 
-        let cek = chacha20poly1305_ietf::gen_key();
-
         for their_vk in receiver_list {
             //encrypt sender verkey
             let enc_cek = self.crypto_service.crypto_box_seal(&their_vk, &cek[..])?;
@@ -420,13 +422,14 @@ impl CryptoCommandExecutor {
                 },
             });
         } // end for-loop
-        Ok((self._base64_encode_protected(encrypted_recipients_struct, false)?, cek))
+        Ok(self._base64_encode_protected(encrypted_recipients_struct, false)?)
     }
 
     fn _prepare_protected_authcrypt(&self,
+                                    cek: &chacha20poly1305_ietf::Key,
                                     receiver_list: Vec<String>, sender_vk: &str,
                                     wallet_handle: WalletHandle,
-    ) -> IndyResult<(String, chacha20poly1305_ietf::Key)> {
+    ) -> IndyResult<String> {
         let mut encrypted_recipients_struct : Vec<Recipient> = vec![];
 
         //get my_key from my wallet
@@ -436,9 +439,6 @@ impl CryptoCommandExecutor {
             &RecordOptions::id_value()
         )?;
 
-        //generate cek
-        let cek = chacha20poly1305_ietf::gen_key();
-
         //encrypt cek for recipient
         for their_vk in receiver_list {
             let (enc_cek, iv) = self.crypto_service.crypto_box(&my_key, &their_vk, &cek[..])?;
@@ -456,7 +456,7 @@ impl CryptoCommandExecutor {
             });
         } // end for-loop
 
-        Ok((self._base64_encode_protected(encrypted_recipients_struct, true)?, cek))
+        Ok(self._base64_encode_protected(encrypted_recipients_struct, true)?)
     }
 
     fn _base64_encode_protected(&self, encrypted_recipients_struct: Vec<Recipient>, alg_is_authcrypt: bool) -> IndyResult<String> {
diff --git a/libindy/src/utils/crypto/chacha20poly1305_ietf/sodium.rs b/libindy/src/utils/crypto/chacha20poly1305_ietf/sodium.rs
index e271f0dcf1..71cb8b8e7f 100644
--- a/libindy/src/utils/crypto/chacha20poly1305_ietf/sodium.rs
+++ b/libindy/src/utils/crypto/chacha20poly1305_ietf/sodium.rs
@@ -3,7 +3,8 @@ extern crate zeroize;
 
 use domain::wallet::KeyDerivationMethod;
 use errors::prelude::*;
-use self::sodiumoxide::crypto::aead::chacha20poly1305_ietf;
+use self::sodiumoxide::crypto::aead::
+chacha20poly1305_ietf;
 use self::sodiumoxide::utils;
 use std::cmp;
 use std::io;