Length extension attack (just for SHA1 at the moment)