dropped hmac_sha1 function as it's not actually called by anyone