HMAC and rsa sign verify