I think you need to Benchmark your approaches. If your encryption tool follows rfc2440, then the steps you outlined are exactly what happens.