use sha1 instead of md5