HMAC based message signing and verification