You wouldn&#x27;t have to implement sha1(), I bet it&#x27;s already there. It&#x27;d be the same as calling strcmp; the difficulty is hiding the hash (although it probably wouldn&#x27;t be the only &quot;magic number&quot; in their code), but given enough time and creativity you could come up with a clever solution. For example, you could check one byte of the hash at a time in different parts of the auth function.