Why you should never use hash functions for message authentication