I e-mailed visa about something similar with their new upcoming V.me service. They suggest that you use md5 to generate the tag which is known to be weaker than SHA-1. I was a little surprised that a company like Visa would mess up on crypto and not know to use HMAC instead of just a simple hash. Never heard a response from them either.
Here's what their documentation says:
Language Standard Syntax for Generating MD5 Hash
Java import org.apache.commons.codec.digest.*;
hash = DigestUtils.md5Hex(string1+string2+string3...);
PHP $hash = md5($string1.$string2.$string3...);
Ruby require 'digest/md5'
hash = Digest::MD5.hexdigest(string1+string2+string3...)
Python import md5
hash = md5.new(string1+string2+string3...)
Here's what their documentation says:
Language Standard Syntax for Generating MD5 Hash Java import org.apache.commons.codec.digest.*; hash = DigestUtils.md5Hex(string1+string2+string3...); PHP $hash = md5($string1.$string2.$string3...); Ruby require 'digest/md5' hash = Digest::MD5.hexdigest(string1+string2+string3...) Python import md5 hash = md5.new(string1+string2+string3...)