unforseen tamper detection issue, so SHA256 is disabled, but length checking is in place