TT  -> Hash(TT) = Ke || Ka
    AAD -> KDF(Ka, nil, "ConfirmationKeys" || AAD) = KcA || KcB