The user’s passphrase R which is m bytes

The user’s encryption key share where and are 256 bits each

・ Represent R as where consists of the first bytes of R and consists of the rightmost bytes of R

・ Let = SHA-512(r1) and = SHA-512(r2)

・ Represent and as and where, , , are each 256 bits

・ Set and

・ If either or is or, ask user to input new passphrase and start the process again

・ Output