mix = sha1( challenge + sha1(password) )