use sha256^2 instead of sha1 for the identifier and verifier