Use HMAC-SHA-256 instead of HMAC-MD5

This merge request changes the challenge authentication algorithm from MD5 to SHA-256.