fixed bug with HMAC