Input
Output
The user’s passphrase R which is m bytes
The user’s encryption key share 
where 
and 
are 256 bits each
・ Represent R as 
where 
consists of the first 
bytes of R and 
consists of the rightmost 
bytes of R
・ Let 
= SHA-512(r1) and 
= SHA-512(r2)
・ Represent 
and 
as 
and 
where
, 
, 
, 
are each 256 bits
・ Set 
and 
・ If either 
or 
is 
or
, ask user to input new passphrase and start the process again
・ Output 