This was completely wrong, but I guess it happened to work correctly anyway due to timing reasons (MD5 is faster than SHA-1 + AES).