diff --git a/src/apps/wallet/__init__.py b/src/apps/wallet/__init__.py
index aff00cbf8..f02a74ca1 100644
--- a/src/apps/wallet/__init__.py
+++ b/src/apps/wallet/__init__.py
@@ -53,8 +53,8 @@ def dispatch_SignIdentity(*args, **kwargs):
 
 @unimport
 def dispatch_CipherKeyValue(*args, **kwargs):
-    from .cipher_key_value import layout_cipher_key_value
-    return layout_cipher_key_value(*args, **kwargs)
+    from .cipher_key_value import cipher_key_value
+    return cipher_key_value(*args, **kwargs)
 
 
 def boot():
diff --git a/src/apps/wallet/cipher_key_value.py b/src/apps/wallet/cipher_key_value.py
index f170ccb8b..20f93b92d 100644
--- a/src/apps/wallet/cipher_key_value.py
+++ b/src/apps/wallet/cipher_key_value.py
@@ -1,11 +1,36 @@
-from trezor import ui
+from trezor import ui, wire
+from trezor.crypto import hmac
+from trezor.crypto.aes import AES_CBC_Decrypt, AES_CBC_Encrypt
+from trezor.crypto.hashlib import sha512
+from trezor.messages.CipheredKeyValue import CipheredKeyValue
+from trezor.messages.FailureType import DataError
+from trezor.ui.text import Text
+from apps.common import seed
+from apps.common.confirm import require_confirm
 
+from ubinascii import hexlify
 
-def cipher_key_value(msg, seckey: bytes) -> bytes:
-    from trezor.crypto.hashlib import sha512
-    from trezor.crypto import hmac
-    from trezor.crypto.aes import AES_CBC_Encrypt, AES_CBC_Decrypt
 
+async def cipher_key_value(ctx, msg):
+    if len(msg.value) % 16 > 0:
+        raise wire.FailureError(
+            DataError, 'Value length must be a multiple of 16')
+
+    encrypt = msg.encrypt
+    decrypt = not msg.encrypt
+    if (encrypt and msg.ask_on_encrypt) or (decrypt and msg.ask_on_decrypt):
+        if encrypt:
+            title = 'Encrypt value'
+        else:
+            title = 'Decrypt value'
+        await require_confirm(ctx, Text(title, ui.ICON_DEFAULT, msg.key))
+
+    node = await seed.derive_node(ctx, msg.address_n)
+    value = compute_cipher_key_value(msg, node.private_key())
+    return CipheredKeyValue(value=value)
+
+
+def compute_cipher_key_value(msg, seckey: bytes) -> bytes:
     data = msg.key
     data += 'E1' if msg.ask_on_encrypt else 'E0'
     data += 'D1' if msg.ask_on_decrypt else 'D0'
@@ -22,22 +47,3 @@ def cipher_key_value(msg, seckey: bytes) -> bytes:
         aes = AES_CBC_Decrypt(key=key, iv=iv)
 
     return aes.update(msg.value)
-
-
-async def layout_cipher_key_value(ctx, msg):
-    from trezor.messages.CipheredKeyValue import CipheredKeyValue
-    from ..common import seed
-
-    if len(msg.value) % 16 > 0:
-        raise ValueError('Value length must be a multiple of 16')
-
-    ui.display.clear()
-    ui.display.text(10, 30, 'CipherKeyValue',
-                    ui.BOLD, ui.LIGHT_GREEN, ui.BG)
-    ui.display.text(10, 60, msg.key, ui.MONO, ui.FG, ui.BG)
-
-    node = await seed.derive_node(ctx, msg.address_n)
-
-    value = cipher_key_value(msg, node.private_key())
-
-    return CipheredKeyValue(value=value)
diff --git a/src/trezor/ui/text.py b/src/trezor/ui/text.py
index 3d8338312..72b791327 100644
--- a/src/trezor/ui/text.py
+++ b/src/trezor/ui/text.py
@@ -1,6 +1,8 @@
 from micropython import const
 from trezor import ui
+from trezor.ui import display
 
+DISPLAY_WIDTH = const(240)
 TEXT_HEADER_HEIGHT = const(48)
 TEXT_LINE_HEIGHT = const(26)
 TEXT_MARGIN_LEFT = const(14)