Calculate HMAC, not hash