client-server one-time password s/key security md5 encryption replay attack md4 authentication hash function