Fix aes128_hash() missing XOR