Index: src/common/util.c
--- src/common/util.c.orig
+++ src/common/util.c
@@ -1435,6 +1435,7 @@ challengeauth_response (const char *username, const ch
 	char *passhash;
 	char *key;
 	char *keyhash;
+	unsigned char md[EVP_MAX_MD_SIZE];
 	unsigned char *digest;
 	GString *buf = g_string_new_len (NULL, SHA256_DIGEST_LENGTH * 2);
 
@@ -1451,7 +1452,7 @@ challengeauth_response (const char *username, const ch
 	keyhash = str_sha256hash (key);
 	g_free (key);
 
-	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), NULL, NULL);
+	digest = HMAC (EVP_sha256 (), keyhash, strlen (keyhash), (unsigned char *) challenge, strlen (challenge), md, NULL);
 	g_free (keyhash);
 
 	for (i = 0; i < SHA256_DIGEST_LENGTH; i++)