Prime, P: 3fffffffffffffffffffffffffffffffb Key in network order: [85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b] s in network order : [0103808afb0db2fd4abff6af4149f51b] s as 128-bit number: 0x1bf54941aff6bf4afdb20dfb8a800301 (Correct s : 0x1bf54941aff6bf4afdb20dfb8a800301) r in network order : [85d6be7857556d337f4452fe42d506a8] r as 128-bit number: 0xa806d542fe52447f336d555778bed685 r after clamping : 0x806d5400e52447c036d555408bed685 (Correct r : 0x806d5400e52447c036d555408bed685) Message in network order: [43727970746f6772617068696320466f72756d2052657365617263682047726f7570] msg length in bytes = 34 => 3 blocks 0x70756f7247206863726165736552206d75726f4620636968706172676f7470797243 Acc = 0 Block = 6f4620636968706172676f7470797243 Block with 0x01 byte = 16f4620636968706172676f7470797243 Acc + block = = 16f4620636968706172676f7470797243 (Acc + Block) * r = b83fe991ca66800489155dcd69e8426ba2779453994ac90ed284034da565ecf ((Acc + Block) * r) % P = 2c88c77849d64ae9147ddeb88e69c83fc Acc = 2c88c77849d64ae9147ddeb88e69c83fc Block = 6f7247206863726165736552206d7572 Block with 0x01 byte = 16f7247206863726165736552206d7572 Acc + block = = 437febea505c820f2ad5150db0709f96e (Acc + Block) * r = 21dcc992d0c659ba4036f65bb7f88562ae59b32c2b3b8f7efc8b00f78e548a26 ((Acc + Block) * r) % P = 2d8adaf23b0337fa7cccfb4ea344b30de Acc = 2d8adaf23b0337fa7cccfb4ea344b30de Block = 7075 Block with 0x01 byte = 17075 Acc + block = = 2d8adaf23b0337fa7cccfb4ea344ca153 (Acc + Block) * r = 16d8e08a0f3fe1de4fe4a15486aca7a270a29f1e6c849221e4a6798b8e45321f ((Acc + Block) * r) % P = 28d31b7caff946c77c8844335369d03a7 Acc + s = 2a927010caf8b2bc2c6365130c11d06a8 Serialize to get the tag as a 16-byte octet string: Computed: [a8061dc1305136c6c22b8baf0c0127a9] Correct: [a8061dc1305136c6c22b8baf0c0127a9] Result is true