Prover(Context, idProver, idVerifier, w0, w1):
   (x, X) = ProverInit(w0)
   Transmit(X)
   Y = Receive()
   (Z, V) = ProverFinish(w0, w1, x, Y)
   TT = ComputeTranscript(Context, idProver, idVerifier, X, Y,
                          Z, V, w0)
   (K_confirmP, K_confirmV, K_shared) = ComputeKeySchedule(TT)
   expected_confirmV = MAC(K_confirmV, X)
   confirmV = Receive()
   if not_equal_constant_time(expected_confirmV, confirmV):
      raise "invalid confirmation message"

   confirmP = MAC(K_confirmP, Y)
   Transmit(confirmP)

   return K_shared

Verifier(Context, idProver, idVerifier, w0, L):
   X = Receive()
   (Y, Z, V) = VerifierFinish(w0, L, X)
   Transmit(Y)
   TT = ComputeTranscript(Context, idProver, idVerifier, X, Y,
                          Z, V, w0)
   (K_confirmP, K_confirmV, K_shared) = ComputeKeySchedule(TT)
   confirmV = MAC(K_confirmV, X)
   Transmit(confirmV)

   expected_confirmP = MAC(K_confirmP, Y)
   confirmP = Receive()
   if not_equal_constant_time(expected_confirmP, confirmP):
      raise "invalid confirmation message"

   return K_shared