Appendix A.  Test Examples for GOST-Based Protocol Implementation

   The following test examples are made for the protocol implementation
   that is based on the Russian national standards GOST R 34.10-2012
   [GOST3410-2012] and GOST R 34.11-2012 [GOST3411-2012].  The English
   versions of these standards can be found in [RFC7091] and [RFC6986].

A.1.  Examples of Points

   There is one point Q_1 for each of the elliptic curves below.  These
   points were constructed using the method described in Section 5 for
   N = 1 and the GOST R 34.11-2012 hash function (see [RFC6986]).  If
   2^254 < q < 2^256, the GOST R 34.11-2012 hash function with 256-bit
   output is used, and if 2^508 < q < 2^512, the GOST R 34.11-2012 hash
   function with 512-bit output is used.

   Each of the points complies with the GOST R 34.10-2012
   [GOST3410-2012] standard and is represented by a pair of (X, Y)
   coordinates in the canonical form and also by a pair of (U, V)
   coordinates in the twisted Edwards form in accordance with [RFC7836]
   for the curves that have equivalent representations in this form.
   There is a SEED value for each point, by which it was generated.

   id-GostR3410-2001-CryptoPro-A-ParamSet,
   id-GostR3410-2001-CryptoPro-B-ParamSet, etc. are defined in
   [RFC4357].  id-tc26-gost-3410-2012-512-paramSetA,
   id-tc26-gost-3410-2012-512-paramSetB, etc. are defined in [RFC7836].

A.1.1.  Curve id-GostR3410-2001-CryptoPro-A-ParamSet

  Point Q_1
  X = 0xa69d51caf1a309fa9e9b66187759b0174c274e080356f23cfcbfe84d396ad7bb
  Y = 0x5d26f29ecc2e9ac0404dcf7986fa55fe94986362170f54b9616426a659786dac
  SEED = 0x0001

A.1.2.  Curve id-GostR3410-2001-CryptoPro-B-ParamSet

  Point Q_1
  X = 0x3d715a874a4b17cb3b517893a9794a2b36c89d2ffc693f01ee4cc27e7f49e399
  Y = 0x1c5a641fcf7ce7e87cdf8cea38f3db3096eace2fad158384b53953365f4fe7fe
  SEED = 0x0000

A.1.3.  Curve id-GostR3410-2001-CryptoPro-C-ParamSet

  Point Q_1
  X = 0x1e36383e43bb6cfa2917167d71b7b5dd3d6d462b43d7c64282ae67dfbec2559d
  Y = 0x137478a9f721c73932ea06b45cf72e37eb78a63f29a542e563c614650c8b6399
  SEED = 0x0006

A.1.4.  Curve id-tc26-gost-3410-2012-512-paramSetA

  Point Q_1
  X = 0x2a17f8833a32795327478871b5c5e88aefb91126c64b4b8327289bea62559425
        d18198f133f400874328b220c74497cd240586cb249e158532cb8090776cd61c
  Y = 0x728f0c4a73b48da41ce928358fad26b47a6e094e9362bae82559f83cddc4ec3a
        4676bd3707edeaf4cd85e99695c64c241edc622be87dc0cf87f51f4367f723c5
  SEED = 0x0001

A.1.5.  Curve id-tc26-gost-3410-2012-512-paramSetB

  Point Q_1
  X = 0x7e1fae8285e035bec244bef2d0e5ebf436633cf50e55231dea9c9cf21d4c8c33
        df85d4305de92971f0a4b4c07e00d87bdbc720eb66e49079285aaf12e0171149
  Y = 0x2cc89998b875d4463805ba0d858a196592db20ab161558ff2f4ef7a85725d209
        53967ae621afdeae89bb77c83a2528ef6fce02f68bda4679d7f2704947dbc408
  SEED = 0x0000

A.1.6.  Curve id-tc26-gost-3410-2012-256-paramSetA

  Point Q_1
  X = 0xb51adf93a40ab15792164fad3352f95b66369eb2a4ef5efae32829320363350e
  Y = 0x74a358cc08593612f5955d249c96afb7e8b0bb6d8bd2bbe491046650d822be18
  U = 0xebe97afffe0d0f88b8b0114b8de430ac2b34564e4420af24728e7305bc48aeaa
  V = 0x828f2dcf8f06612b4fea4da72ca509c0f76dd37df424ea22bfa6f4f65748c1e4
  SEED = 0x0001

A.1.7.  Curve id-tc26-gost-3410-2012-512-paramSetC

  Point Q_1
  X = 0x489c91784e02e98f19a803abca319917f37689e5a18965251ce2ff4e8d8b298f
        5ba7470f9e0e713487f96f4a8397b3d09a270c9d367eb5e0e6561adeeb51581d
  Y = 0x684ea885aca64eaf1b3fee36c0852a3be3bd8011b0ef18e203ff87028d6eb5db
        2c144a0dcc71276542bfd72ca2a43fa4f4939da66d9a60793c704a8c94e16f18
  U = 0x3a3496f97e96b3849a4fa7db60fd93858bde89958e4beebd05a6b3214216b37c
        9d9a560076e7ea59714828b18fbfef996ffc98bf3dc9f2d3cb0ed36a0d6ace88
  V = 0x52d884c8bf0ad6c5f7b3973e32a668daa1f1ed092eff138dae6203b2ccdec561
        47464d35fec4b727b2480eb143074712c76550c7a54ff3ea26f70059480dcb50
  SEED = 0x0013

A.2.  Test Examples of SESPAKE

   This protocol implementation uses the GOST R 34.11-2012 hash function
   (see [RFC6986]) with 256-bit output as the H function and the
   HMAC_GOSTR3411_2012_512 function defined in [RFC7836] as a PRF for
   the F function.  The parameter len is considered equal to 256 if
   2^254 < q < 2^256, and equal to 512 if 2^508 < q < 2^512.

   The test examples for the point of each curve in Appendix A.1 are
   given below.

A.2.1.  Curve id-GostR3410-2001-CryptoPro-A-ParamSet

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0xA69D51CAF1A309FA9E9B66187759B0174C274E080356F23CFCBFE84D396AD7BB
  Y = 0x5D26F29ECC2E9AC0404DCF7986FA55FE94986362170F54B9616426A659786DAC

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67

The coordinates of the point Q_PW are:

  X = 0x59495655D1E7C7424C622485F575CCF121F3122D274101E8AB734CC9C9A9B45E
  Y = 0x48D1C311D33C9B701F3B03618562A4A07A044E3AF31E3999E67B487778B53C62

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x1F2538097D5A031FA68BBB43C84D12B3DE47B7061C0D5E24993E0C873CDBA6B3
alpha*P:
  X = 0xBBC77CF42DC1E62D06227935379B4AA4D14FEA4F565DDF4CB4FA4D31579F9676
  Y = 0x8E16604A4AFDF28246684D4996274781F6CB80ABBBA1414C1513EC988509DABF
u_1:
  X = 0x204F564383B2A76081B907F3FCA8795E806BE2C2ED228730B5B9E37074229E8D
  Y = 0xE84F9E442C61DDE37B601A7F37E7CA11C56183FA071DFA9320EDE3E7521F9D41

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0xDC497D9EF6324912FD367840EE509A2032AEDB1C0A890D133B45F596FCCBD45D
src:
  2E 01 A3 D8 4F DB 7E 94 7B B8 92 9B E9 36 3D F5
  F7 25 D6 40 1A A5 59 D4 1A 67 24 F8 D5 F1 8E 2C
  A0 DB A9 31 05 CD DA F4 BF AE A3 90 6F DD 71 9D
  BE B2 97 B6 A1 7F 4F BD 96 DC C7 23 EA 34 72 A9
K_B:
  1A 62 65 54 92 1D C2 E9 2B 4D D8 D6 7D BE 5A 56
  62 E5 62 99 37 3F 06 79 95 35 AD 26 09 4E CA A3
beta*P:
  X = 0x6097341C1BE388E83E7CA2DF47FAB86E2271FD942E5B7B2EB2409E49F742BC29
  Y = 0xC81AA48BDB4CA6FA0EF18B9788AE25FE30857AA681B3942217F9FED151BAB7D0
u_2:
  X = 0xDC137A2F1D4A35AEBC0ECBF6D3486DEF8480BFDC752A86DD4F207D7D1910E22D
  Y = 0x7532F0CE99DCC772A4D77861DAE57C138F07AE304A727907FB0AAFDB624ED572

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  1A 62 65 54 92 1D C2 E9 2B 4D D8 D6 7D BE 5A 56
  62 E5 62 99 37 3F 06 79 95 35 AD 26 09 4E CA A3

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  23 7A 03 C3 5F 49 17 CE 86 B3 58 94 45 F1 1E 1A
  6F 10 8B 2F DD 0A A9 E8 10 66 4B 25 59 60 B5 79

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  9E E0 E8 73 3B 06 98 50 80 4D 97 98 73 1D CD 1C
  FF E8 7A 3B 15 1F 0A E8 3E A9 6A FB 4F FC 31 E4

A.2.2.  Curve id-GostR3410-2001-CryptoPro-B-ParamSet

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0x3D715A874A4B17CB3B517893A9794A2B36C89D2FFC693F01EE4CC27E7F49E399
  Y = 0x1C5A641FCF7CE7E87CDF8CEA38F3DB3096EACE2FAD158384B53953365F4FE7FE

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67

The coordinates of the point Q_PW are:

  X = 0x6DC2AE26BC691FCA5A73D9C452790D15E34BA5404D92955B914C8D2662ABB985
  Y = 0x3B02AAA9DD65AE30C335CED12F3154BBAC059F66B088306747453EDF6E5DB077

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x499D72B90299CAB0DA1F8BE19D9122F622A13B32B730C46BD0664044F2144FAD
alpha*P:
  X = 0x61D6F916DB717222D74877F179F7EBEF7CD4D24D8C1F523C048E34A1DF30F8DD
  Y = 0x3EC48863049CFCFE662904082E78503F4973A4E105E2F1B18C69A5E7FB209000
u_1:
  X = 0x21F5437AF33D2A1171A070226B4AE82D3765CD0EEBFF1ECEFE158EBC50C63AB1
  Y = 0x5C9553B5D11AAAECE738AD9A9F8CB4C100AD4FA5E089D3CBCCEA8C0172EB7ECC

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0x0F69FF614957EF83668EDC2D7ED614BE76F7B253DB23C5CC9C52BF7DF8F4669D
src:
  50 14 0A 5D ED 33 43 EF C8 25 7B 79 E6 46 D9 F0
  DF 43 82 8C 04 91 9B D4 60 C9 7A D1 4B A3 A8 6B
  00 C4 06 B5 74 4D 8E B1 49 DC 8E 7F C8 40 64 D8
  53 20 25 3E 57 A9 B6 B1 3D 0D 38 FE A8 EE 5E 0A
K_B:
  A6 26 DE 01 B1 68 0F F7 51 30 09 12 2B CE E1 89
  68 83 39 4F 96 03 01 72 45 5C 9A E0 60 CC E4 4A
beta*P:
  X = 0x33BC6F7E9C0BA10CFB2B72546C327171295508EA97F8C8BA9F890F2478AB4D6C
  Y = 0x75D57B396C396F492F057E9222CCC686437A2AAD464E452EF426FC8EEED1A4A6
u_2:
  X = 0x089DDEE718EE8A224A7F37E22CFFD731C25FCBF58860364EE322412CDCEF99AC
  Y = 0x0ECE03D4E395A6354C571871BEF425A532D5D463B0F8FD427F91A43E20CDA55C

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  A6 26 DE 01 B1 68 0F F7 51 30 09 12 2B CE E1 89
  68 83 39 4F 96 03 01 72 45 5C 9A E0 60 CC E4 4A

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  B9 1F 43 90 2A FA 90 D3 E5 C6 91 CB DC 43 8A 1E
  BF 54 7F 4C 2C B4 14 43 CC 38 79 7B E2 47 A7 D0

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  79 D5 54 83 FD 99 B1 2B CC A5 ED C6 BB E1 D7 B9
  15 CE 04 51 B0 89 1E 77 5D 4A 61 CB 16 E3 3F CC

A.2.3.  Curve id-GostR3410-2001-CryptoPro-C-ParamSet

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0x1E36383E43BB6CFA2917167D71B7B5DD3D6D462B43D7C64282AE67DFBEC2559D
  Y = 0x137478A9F721C73932EA06B45CF72E37EB78A63F29A542E563C614650C8B6399

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67

The coordinates of the point Q_PW are:

  X = 0x945821DAF91E158B839939630655A3B21FF3E146D27041E86C05650EB3B46B59
  Y = 0x3A0C2816AC97421FA0E879605F17F0C9C3EB734CFF196937F6284438D70BDC48

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x3A54AC3F19AD9D0B1EAC8ACDCEA70E581F1DAC33D13FEAFD81E762378639C1A8
alpha*P:
  X = 0x96B7F09C94D297C257A7DA48364C0076E59E48D221CBA604AE111CA3933B446A
  Y = 0x54E4953D86B77ECCEB578500931E822300F7E091F79592CA202A020D762C34A6
u_1:
  X = 0x81BBD6FCA464D2E2404A66D786CE4A777E739A89AEB68C2DAC99D53273B75387
  Y = 0x6B6DBD922EA7E060998F8B230AB6EF07AD2EC86B2BF66391D82A30612EADD411

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0x448781782BF7C0E52A1DD9E6758FD3482D90D3CFCCF42232CF357E59A4D49FD4
src:
  16 A1 2D 88 54 7E 1C 90 06 BA A0 08 E8 CB EC C9
  D1 68 91 ED C8 36 CF B7 5F 8E B9 56 FA 76 11 94
  D2 8E 25 DA D3 81 8D 16 3C 49 4B 05 9A 8C 70 A5
  A1 B8 8A 7F 80 A2 EE 35 49 30 18 46 54 2C 47 0B
K_B:
  BE 7E 7E 47 B4 11 16 F2 C7 7E 3B 8F CE 40 30 72
  CA 82 45 0D 65 DE FC 71 A9 56 49 E4 DE EA EC EE
beta*P:
  X = 0x4B9C0AB55A938121F282F48A2CC4396EB16E7E0068B495B0C1DD4667786A3EB7
  Y = 0x223460AA8E09383E9DF9844C5A0F2766484738E5B30128A171B69A77D9509B96
u_2:
  X = 0x2ED9B903254003A672E89EBEBC9E31503726AD124BB5FC0A726EE0E6FCCE323E
  Y = 0x4CF5E1042190120391EC8DB62FE25E9E26EC60FB0B78B242199839C295FCD022

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  BE 7E 7E 47 B4 11 16 F2 C7 7E 3B 8F CE 40 30 72
  CA 82 45 0D 65 DE FC 71 A9 56 49 E4 DE EA EC EE

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  D3 B4 1A E2 C9 43 11 36 06 3E 6D 08 A6 1B E9 63
  BD 5E D6 A1 FF F9 37 FA 8B 09 0A 98 E1 62 BF ED

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  D6 B3 9A 44 99 BE D3 E0 4F AC F9 55 50 2D 16 B2
  CB 67 4A 20 5F AC 3C D8 3D 54 EC 2F D5 FC E2 58

A.2.4.  Curve id-tc26-gost-3410-2012-512-paramSetA

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0x2A17F8833A32795327478871B5C5E88AEFB91126C64B4B8327289BEA62559425
        D18198F133F400874328B220C74497CD240586CB249E158532CB8090776CD61C
  Y = 0x728F0C4A73B48DA41CE928358FAD26B47A6E094E9362BAE82559F83CDDC4EC3A
        4676BD3707EDEAF4CD85E99695C64C241EDC622BE87DC0CF87F51F4367F723C5

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67
  1C 62 13 E3 93 0E FD DA 26 45 17 92 C6 20 81 22
  EE 60 D2 00 52 0D 69 5D FD 9F 5F 0F D5 AB A7 02

The coordinates of the point Q_PW are:

  X = 0x0C0AB53D0E0A9C607CAD758F558915A0A7DC5DC87B45E9A58FDDF30EC3385960
        283E030CD322D9E46B070637785FD49D2CD711F46807A24C40AF9A42C8E2D740
  Y = 0xDF93A8012B86D3A3D4F8A4D487DA15FC739EB31B20B3B0E8C8C032AAF8072C63
        37CF7D5B404719E5B4407C41D9A3216A08CA69C271484E9ED72B8AAA52E28B8B

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x3CE54325DB52FE798824AEAD11BB16FA766857D04A4AF7D468672F16D90E7396
        046A46F815693E85B1CE5464DA9270181F82333B0715057BBE8D61D400505F0E
alpha*P:
  X = 0xB93093EB0FCC463239B7DF276E09E592FCFC9B635504EA4531655D76A0A3078E
        2B4E51CFE2FA400CC5DE9FBE369DB204B3E8ED7EDD85EE5CCA654C1AED70E396
  Y = 0x809770B8D910EA30BD2FA89736E91DC31815D2D9B31128077EEDC371E9F69466
        F497DC64DD5B1FADC587F860EE256109138C4A9CD96B628E65A8F590520FC882
u_1:
  X = 0xE7510A9EDD37B869566C81052E2515E1563FDFE79F1D782D6200F33C3CC2764D
        40D0070B73AD5A47BAE9A8F2289C1B07DAC26A1A2FF9D3ECB0A8A94A4F179F13
  Y = 0xBA333B912570777B626A5337BC7F727952460EEBA2775707FE4537372E902DF5
        636080B25399751BF48FB154F3C2319A91857C23F39F89EF54A8F043853F82DE

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0xB5C286A79AA8E97EC0E19BC1959A1D15F12F8C97870BA9D68CC12811A56A3BB1
        1440610825796A49D468CDC9C2D02D76598A27973D5960C5F50BCE28D8D345F4
src:
  84 59 C2 0C B5 C5 32 41 6D B9 28 EB 50 C0 52 0F
  B2 1B 9C D3 9A 4E 76 06 B2 21 BE 15 CA 1D 02 DA
  08 15 DE C4 49 79 C0 8C 7D 23 07 AF 24 7D DA 1F
  89 EC 81 20 69 F5 D9 CD E3 06 AF F0 BC 3F D2 6E
  D2 01 B9 53 52 A2 56 06 B6 43 E8 88 30 2E FC 8D
  3E 95 1E 3E B4 68 4A DB 5C 05 7B 8F 8C 89 B6 CC
  0D EE D1 00 06 5B 51 8A 1C 71 7F 76 82 FF 61 2B
  BC 79 8E C7 B2 49 0F B7 00 3F 94 33 87 37 1C 1D
K_B:
  53 24 DE F8 48 B6 63 CC 26 42 2F 5E 45 EE C3 4C
  51 D2 43 61 B1 65 60 CA 58 A3 D3 28 45 86 CB 7A
beta*P:
  X = 0x238B38644E440452A99FA6B93D9FD7DA0CB83C32D3C1E3CFE5DF5C3EB0F9DB91
        E588DAEDC849EA2FB867AE855A21B4077353C0794716A6480995113D8C20C7AF
  Y = 0xB2273D5734C1897F8D15A7008B862938C8C74CA7E877423D95243EB7EBD02FD2
        C456CF9FC956F078A59AA86F19DD1075E5167E4ED35208718EA93161C530ED14
u_2:
  X = 0xC33844126216E81B372001E77C1FE9C7547F9223CF7BB865C4472EC18BE0C79A
        678CC5AE4028E3F3620CCE355514F1E589F8A0C433CEAFCBD2EE87884D953411
  Y = 0x8B520D083AAF257E8A54EC90CBADBAF4FEED2C2D868C82FF04FCBB9EF6F38E56
        F6BAF9472D477414DA7E36F538ED223D2E2EE02FAE1A20A98C5A9FCF03B6F30D

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  53 24 DE F8 48 B6 63 CC 26 42 2F 5E 45 EE C3 4C
  51 D2 43 61 B1 65 60 CA 58 A3 D3 28 45 86 CB 7A

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  E8 EF 9E A8 F1 E6 B1 26 68 E5 8C D2 2D D8 EE C6
  4A 16 71 00 39 FA A6 B6 03 99 22 20 FA FE 56 14

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  61 14 34 60 83 6B 23 5C EC D0 B4 9B 58 7E A4 5D
  51 3C 3A 38 78 3F 1C 9D 3B 05 97 0A 95 6A 55 BA

A.2.5.  Curve id-tc26-gost-3410-2012-512-paramSetB

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0x7E1FAE8285E035BEC244BEF2D0E5EBF436633CF50E55231DEA9C9CF21D4C8C33
        DF85D4305DE92971F0A4B4C07E00D87BDBC720EB66E49079285AAF12E0171149
  Y = 0x2CC89998B875D4463805BA0D858A196592DB20AB161558FF2F4EF7A85725D209
        53967AE621AFDEAE89BB77C83A2528EF6FCE02F68BDA4679D7F2704947DBC408

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67
  1C 62 13 E3 93 0E FD DA 26 45 17 92 C6 20 81 22
  EE 60 D2 00 52 0D 69 5D FD 9F 5F 0F D5 AB A7 02

The coordinates of the point Q_PW are:

  X = 0x7D03E65B8050D1E12CBB601A17B9273B0E728F5021CD47C8A4DD822E4627BA5F
        9C696286A2CDDA9A065509866B4DEDEDC4A118409604AD549F87A60AFA621161
  Y = 0x16037DAD45421EC50B00D50BDC6AC3B85348BC1D3A2F85DB27C3373580FEF87C
        2C743B7ED30F22BE22958044E716F93A61CA3213A361A2797A16A3AE62957377

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x715E893FA639BF341296E0623E6D29DADF26B163C278767A7982A989462A3863
        FE12AEF8BD403D59C4DC4720570D4163DB0805C7C10C4E818F9CB785B04B9997
alpha*P:
  X = 0x10C479EA1C04D3C2C02B0576A9C42D96226FF033C1191436777F66916030D87D
        02FB93738ED7669D07619FFCE7C1F3C4DB5E5DF49E2186D6FA1E2EB5767602B9
  Y = 0x039F6044191404E707F26D59D979136A831CCE43E1C5F0600D1DDF8F39D0CA3D
        52FBD943BF04DDCED1AA2CE8F5EBD7487ACDEF239C07D015084D796784F35436
u_1:
  X = 0x45C05CCE8290762F2470B719B4306D62B2911CEB144F7F72EF11D10498C7E921
        FF163FE72044B4E7332AD8CBEC3C12117820F53A60762315BCEB5BC6DA5CF1E0
  Y = 0x5BE483E382D0F5F0748C4F6A5045D99E62755B5ACC9554EC4A5B2093E121A2DD
        5C6066BC9EDE39373BA19899208BB419E38B39BBDEDEB0B09A5CAAEAA984D02E

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0x30FA8C2B4146C2DBBE82BED04D7378877E8C06753BD0A0FF71EBF2BEFE8DA8F3
        DC0836468E2CE7C5C961281B6505140F8407413F03C2CB1D201EA1286CE30E6D
src:
  3F 04 02 E4 0A 9D 59 63 20 5B CD F4 FD 89 77 91
  9B BA F4 80 F8 E4 FB D1 25 5A EC E6 ED 57 26 4B
  D0 A2 87 98 4F 59 D1 02 04 B5 F4 5E 4D 77 F3 CF
  8A 63 B3 1B EB 2D F5 9F 8A F7 3C 20 9C CA 8B 50
  B4 18 D8 01 E4 90 AE 13 3F 04 F4 F3 F4 D8 FE 8E
  19 64 6A 1B AF 44 D2 36 FC C2 1B 7F 4D 8F C6 A1
  E2 9D 6B 69 AC CE ED 4E 62 AB B2 0D AD 78 AC F4
  FE B0 ED 83 8E D9 1E 92 12 AB A3 89 71 4E 56 0C
K_B:
  D5 90 E0 5E F5 AE CE 8B 7C FB FC 71 BE 45 5F 29
  A5 CC 66 6F 85 CD B1 7E 7C C7 16 C5 9F F1 70 E9
beta*P:
  X = 0x34C0149E7BB91AE377B02573FCC48AF7BFB7B16DEB8F9CE870F384688E3241A3
        A868588CC0EF4364CCA67D17E3260CD82485C202ADC76F895D5DF673B1788E67
  Y = 0x608E944929BD643569ED5189DB871453F13333A1EAF82B2FE1BE8100E775F13D
        D9925BD317B63BFAF05024D4A738852332B64501195C1B2EF789E34F23DDAFC5
u_2:
  X = 0x0535F95463444C4594B5A2E14B35760491C670925060B4BEBC97DE3A3076D1A5
        81F89026E04282B040925D9250201024ACA4B2713569B6C3916A6F3344B840AD
  Y = 0x40E6C2E55AEC31E7BCB6EA0242857FC6DFB5409803EDF4CA20141F72CC3C7988
        706E076765F4F004340E5294A7F8E53BA59CB67502F0044558C854A7D63FE900

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  D5 90 E0 5E F5 AE CE 8B 7C FB FC 71 BE 45 5F 29
  A5 CC 66 6F 85 CD B1 7E 7C C7 16 C5 9F F1 70 E9

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  DE 46 BB 4C 8C E0 8A 6E F3 B8 DF AC CC 1A 39 B0
  8D 8C 27 B6 CB 0F CF 59 23 86 A6 48 F4 E5 BD 8C

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  EC B1 1D E2 06 1C 55 F1 D1 14 59 CB 51 CE 31 40
  99 99 99 2F CA A1 22 2F B1 4F CE AB 96 EE 7A AC

A.2.6.  Curve id-tc26-gost-3410-2012-256-paramSetA

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0xB51ADF93A40AB15792164FAD3352F95B66369EB2A4EF5EFAE32829320363350E
  Y = 0x74A358CC08593612F5955D249C96AFB7E8B0BB6D8BD2BBE491046650D822BE18

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67

The coordinates of the point Q_PW are:

  X = 0xDBF99827078956812FA48C6E695DF589DEF1D18A2D4D35A96D75BF6854237629
  Y = 0x9FDDD48BFBC57BEE1DA0CFF282884F284D471B388893C48F5ECB02FC18D67589

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x147B72F6684FB8FD1B418A899F7DBECAF5FCE60B13685BAA95328654A7F0707F
alpha*P:
  X = 0x33FBAC14EAE538275A769417829C431BD9FA622B6F02427EF55BD60EE6BC2888
  Y = 0x22F2EBCF960A82E6CDB4042D3DDDA511B2FBA925383C2273D952EA2D406EAE46
u_1:
  X = 0xE569AB544E3A13C41077DE97D659A1B7A13F61DDD808B633A5621FE2583A2C43
  Y = 0xA21A743A08F4D715661297ECD6F86553A808925BF34802BF7EC34C548A40B2C0

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0x30D5CFADAA0E31B405E6734C03EC4C5DF0F02F4BA25C9A3B320EE6453567B4CB
src:
  A3 39 A0 B8 9C EF 1A 6F FD 4C A1 28 04 9E 06 84
  DF 4A 97 75 B6 89 A3 37 84 1B F7 D7 91 20 7F 35
  11 86 28 F7 28 8E AA 0F 7E C8 1D A2 0A 24 FF 1E
  69 93 C6 3D 9D D2 6A 90 B7 4D D1 A2 66 28 06 63
K_B:
  7D F7 1A C3 27 ED 51 7D 0D E4 03 E8 17 C6 20 4B
  C1 91 65 B9 D1 00 2B 9F 10 88 A6 CD A6 EA CF 27
beta*P:
  X = 0x2B2D89FAB735433970564F2F28CFA1B57D640CB902BC6334A538F44155022CB2
  Y = 0x10EF6A82EEF1E70F942AA81D6B4CE5DEC0DDB9447512962874870E6F2849A96F
u_2:
  X = 0x190D2F283F7E861065DB53227D7FBDF429CEBF93791262CB29569BDF63C86CA4
  Y = 0xB3F1715721E9221897CCDE046C9B843A8386DBF7818A112F15A02BC820AC8F6D

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  7D F7 1A C3 27 ED 51 7D 0D E4 03 E8 17 C6 20 4B
  C1 91 65 B9 D1 00 2B 9F 10 88 A6 CD A6 EA CF 27

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  F9 29 B6 1A 3C 83 39 85 B8 29 F2 68 55 7F A8 11
  00 9F 82 0A B1 A7 30 B5 AA 33 4C 3E 6B A3 17 7F

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  A2 92 8A 5C F6 20 BB C4 90 0D E4 03 F7 FC 59 A5
  E9 80 B6 8B E0 46 D0 B5 D9 B4 AE 6A BF A8 0B D6

A.2.7.  Curve id-tc26-gost-3410-2012-512-paramSetC

The input protocol parameters in this example take the following
values:

N = 1
ind = 1
ID_A:
  00 00 00 00
ID_B:
  00 00 00 00
PW:
  31 32 33 34 35 36 ('123456')
salt:
  29 23 BE 84 E1 6C D6 AE 52 90 49 F1 F1 BB E9 EB
Q_ind:
  X = 0x489C91784E02E98F19A803ABCA319917F37689E5A18965251CE2FF4E8D8B298F
        5BA7470F9E0E713487F96F4A8397B3D09A270C9D367EB5E0E6561ADEEB51581D
  Y = 0x684EA885ACA64EAF1B3FEE36C0852A3BE3BD8011B0EF18E203FF87028D6EB5DB
        2C144A0DCC71276542BFD72CA2A43FA4F4939DA66D9A60793C704A8C94E16F18

The function F(PW, salt, 2000) takes the following values:

F(PW, salt, 2000):
  BD 04 67 3F 71 49 B1 8E 98 15 5B D1 E2 72 4E 71
  D0 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67
  1C 62 13 E3 93 0E FD DA 26 45 17 92 C6 20 81 22
  EE 60 D2 00 52 0D 69 5D FD 9F 5F 0F D5 AB A7 02

The coordinates of the point Q_PW are:

  X = 0x0185AE6271A81BB7F236A955F7CAA26FB63849813C0287D96C83A15AE6B6A864
        67AB13B6D88CE8CD7DC2E5B97FF5F28FAC2C108F2A3CF3DB5515C9E6D7D210E8
  Y = 0xED0220F92EF771A71C64ECC77986DB7C03D37B3E2AB3E83F32CE5E074A762EC0
        8253C9E2102B87532661275C4B1D16D2789CDABC58ACFDF7318DE70AB64F09B8

During the calculation of u_1 on subject A, the parameter alpha,
the point alpha*P, and u_1 take the following values:

alpha=0x332F930421D14CFE260042159F18E49FD5A54167E94108AD80B1DE60B13DE799
        9A34D611E63F3F870E5110247DF8EC7466E648ACF385E52CCB889ABF491EDFF0
alpha*P:
  X = 0x561655966D52952E805574F4281F1ED3A2D498932B00CBA9DECB42837F09835B
        FFBFE2D84D6B6B242FE7B57F92E1A6F2413E12DDD6383E4437E13D72693469AD
  Y = 0xF6B18328B2715BD7F4178615273A36135BC0BF62F7D8BB9F080164AD36470AD0
        3660F51806C64C6691BADEF30F793720F8E3FEAED631D6A54A4C372DCBF80E82

u_1:
  X = 0x40645B4B9A908D74DEF98886A336F98BAE6ADA4C1AC9B7594A33D5E4A16486C5
        533C7F3C5DD84797AB5B4340BFC70CAF1011B69A01A715E5B9B5432D5151CBD7
  Y = 0x267FBB18D0B79559D1875909F2A15F7B49ECD8ED166CF7F4FCD1F44891550483
        5E80D52BE8D34ADA5B5E159CF52979B1BCFE8F5048DC443A0983AA19192B8407

When processing u_1, calculating the K_B key, and calculating u_2 on
subject B, the parameters beta, src, K_B = HASH(src), beta*P, and u_2
take the following values:

beta=0x38481771E7D054F96212686B613881880BD8A6C89DDBC656178F014D2C093432
        A033EE10415F13A160D44C2AD61E6E2E05A7F7EC286BCEA3EA4D4D53F8634FA2
src:
  4F 4D 64 B5 D0 70 08 E9 E6 85 87 4F 88 2C 3E 1E
  60 A6 67 5E ED 42 1F C2 34 16 3F DE B4 4C 69 18
  B7 BC CE AB 88 A0 F3 FB 78 8D A8 DB 10 18 51 FF
  1A 41 68 22 BA 37 C3 53 CE C4 C5 A5 23 95 B7 72
  AC 93 C0 54 E3 F4 05 5C ED 6F F0 BE E4 A6 A2 4E
  D6 8B 86 FE FA 70 DE 4A 2B 16 08 51 42 A4 DF F0
  5D 32 EC 7D DF E3 04 F5 C7 04 FD FA 06 0F 64 E9
  E8 32 14 00 25 F3 92 E5 03 50 77 0E 3F B6 2C AC
K_B:
  A0 83 84 A6 2F 4B E1 AE 48 98 FC A3 6D AA 3F AA
  45 1B 3E C5 B5 9C E3 75 F8 9E 92 9F 4B 13 25 8C
beta*P:
  X = 0xB7C5818687083433BC1AFF61CB5CA79E38232025E0C1F123B8651E62173CE687
        3F3E6FFE7281C2E45F4F524F66B0C263616ED08FD210AC4355CA3292B51D71C3
  Y = 0x497F14205DBDC89BDDAF50520ED3B1429AD30777310186BE5E68070F016A44E0
        C766DB08E8AC23FBDFDE6D675AA4DF591EB18BA0D348DF7AA40973A2F1DCFA55
u_2:
  X = 0xB772FD97D6FDEC1DA0771BC059B3E5ADF9858311031EAE5AEC6A6EC8104B4105
        C45A6C65689A8EE636C687DB62CC0AFC9A48CA66E381286CC73F374C1DD8F445
  Y = 0xC64F69425FFEB2995130E85A08EDC3A686EC28EE6E8469F7F09BD3BCBDD843AC
        573578DA6BA1CB3F5F069F205233853F06255C4B28586C9A1643537497B1018C

When processing u_2 and calculating the key on subject A, the K_A key
takes the following values:

K_A:
  A0 83 84 A6 2F 4B E1 AE 48 98 FC A3 6D AA 3F AA
  45 1B 3E C5 B5 9C E3 75 F8 9E 92 9F 4B 13 25 8C

The message MAC_A = HMAC(K_A, 0x01 || ID_A || ind || salt || u_1 || u_2)
from subject A takes the following values:

MAC_A:
  12 63 F2 89 0E 90 EE 42 6B 9B A0 8A B9 EA 7F 1F
  FF 26 E1 60 5C C6 5D E2 96 96 91 15 E5 31 76 87

The message MAC_B = HMAC(K_B, 0x02 || ID_B || ind || salt || u_1 || u_2)
from subject B takes the following values:

MAC_B:
  6D FD 06 04 5D 6D 97 A0 E4 19 B0 0E 00 35 B9 D2
  E3 AB 09 8B 7C A4 AD 52 54 60 FA B6 21 85 AA 57