use sha1_to_hex_r() instead of strcpy