code: func newEncryptionWriter(w io.Writer, password passwordFn, fw *fileWriter) (io.Writer, error) {
  	var salt [16]byte
  	_, err := rand.Read(salt[:])
  	if err != nil {
  		return nil, errors.New("zip: unable to generate random salt")
  	}
  	ekey, akey, pwv := generateKeys(password(), salt[:], aes256)
  	fw.hmac = hmac.New(sha1.New, akey)
  	aw := &authWriter{
  		hmac: fw.hmac,
  		w:    w,
  	}
  	es, err := encryptStream(ekey, aw)
  	if err != nil {
  		return nil, err
  	}
  	ew := &encryptionWriter{
  		pwv:   pwv,
  		salt:  salt[:],
  		w:     w,
  		es:    es,
  		first: true,
  	}
  	return ew, nil
  }
docs: // newEncryptionWriter returns an io.Writer that when written to, 1. writes
  // out the salt, 2. writes out pwv, and 3. writes out authenticated, encrypted
  // data. The authcode will be written out in fileWriter.close().