Include pad data as input to message digest (#17)

The calculation of the overall message digest now includes some raw
pad bytes (which are not used for encryption), so that the digest
authenticates the pad without reference to the plaintext.