diff --git a/internal/contentenc/content.go b/internal/contentenc/content.go
index 80bcf54..3643f56 100644
--- a/internal/contentenc/content.go
+++ b/internal/contentenc/content.go
@@ -151,11 +151,9 @@ func (be *ContentEnc) DecryptBlock(ciphertext []byte, blockNo uint64, fileID []b
 
 // EncryptBlocks is like EncryptBlock but takes multiple plaintext blocks.
 func (be *ContentEnc) EncryptBlocks(plaintextBlocks [][]byte, firstBlockNo uint64, fileID []byte) []byte {
-	// Encrypt piecewise.
+	// Encrypt piecewise. This allows easy parallization in the future.
 	ciphertextBlocks := make([][]byte, len(plaintextBlocks))
-	for i, v := range plaintextBlocks {
-		ciphertextBlocks[i] = be.EncryptBlock(v, firstBlockNo+uint64(i), fileID)
-	}
+	be.doEncryptBlocks(plaintextBlocks, ciphertextBlocks, firstBlockNo, fileID)
 	// Concatenate ciphertext into a single byte array.
 	// Size the output buffer for the maximum possible size (all blocks complete)
 	// to allocations in out.Write()
@@ -167,6 +165,13 @@ func (be *ContentEnc) EncryptBlocks(plaintextBlocks [][]byte, firstBlockNo uint6
 	return out.Bytes()
 }
 
+// doEncryptBlocks is called by EncryptBlocks to do the actual encryption work
+func (be *ContentEnc) doEncryptBlocks(in [][]byte, out [][]byte, firstBlockNo uint64, fileID []byte) {
+	for i, v := range in {
+		out[i] = be.EncryptBlock(v, firstBlockNo+uint64(i), fileID)
+	}
+}
+
 // EncryptBlock - Encrypt plaintext using a random nonce.
 // blockNo and fileID are used as associated data.
 // The output is nonce + ciphertext + tag.