don't use crypto:sha (deprecated)