Client-side HMAC