Unintended Features of APIs: Cryptanalysis of Incremental HMAC