Use SHA-256 hash function

MD5 is considered cryptographically broken.
Please see http://www.kb.cert.org/vuls/id/836068.

SHA-256 implementation is taken from PolarSSL and distributed
under the terms GNU General Public License Version 2 or later.
Please see https://polarssl.org.