[SpicyLemonZest]

Does that... work? I guess so, but why does it work?

[tedunangst]

Once the two sha1 states are synchronized, after the first 320 bytes, they will remain in sync as long as you extend them with the same data. (BTW This is why hmac exists, to prevent extension attacks.)