always use SHA1CNG for hashing (don't want non-FIPS compliant SHA1Managed to be chosen as default for some reason)