use 'best' hash for source authentication