dont use streaming hmac because it leaks memory - fixed in otp maint