The first implementation makes sense. However the second "hardened" one is completely broken, because now the cache is encrypted with the dictionary key...