hmac on get2fa