use hmac.finalize()