part of the way to HMAC validation