diff --git a/cng/aes.go b/cng/aes.go
index a5a6deb..1722fa3 100644
--- a/cng/aes.go
+++ b/cng/aes.go
@@ -129,21 +129,22 @@ type cbcCipher struct {
 }
 
 func newCBC(encrypt bool, alg string, key, iv []byte) *cbcCipher {
-	kh, err := newCipherHandle(alg, bcrypt.CHAIN_MODE_CBC, key)
-	if err != nil {
-		panic(err)
-	}
-	x := &cbcCipher{kh: kh, encrypt: encrypt}
+	var blockSize int
 	switch alg {
 	case bcrypt.AES_ALGORITHM:
-		x.blockSize = aesBlockSize
+		blockSize = aesBlockSize
 	case bcrypt.DES_ALGORITHM:
-		x.blockSize = desBlockSize
+		blockSize = desBlockSize
 	default:
 		panic("invalid algorithm: " + alg)
 	}
-	x.SetIV(iv)
+	kh, err := newCipherHandle(alg, bcrypt.CHAIN_MODE_CBC, key)
+	if err != nil {
+		panic(err)
+	}
+	x := &cbcCipher{kh: kh, encrypt: encrypt, blockSize: blockSize}
 	runtime.SetFinalizer(x, (*cbcCipher).finalize)
+	x.SetIV(iv)
 	return x
 }