retry_service_encrypt_decrypt should use iv_len

[martinduke]

16 is hard-coded in places.

In general, the code should accept IVs of 12 or more bytes.