oops -- must use EVP_MD_size, not EVP_MD_block_size