auditee must commit to md5hmac for MS