S₀ = SHA-512(K ∥ N ∥ D)
RKᵢ = HKDF-Expand(S₀, Sᵢ ∥ Cᵢ, 32)
KSᵢ = SHA-512(RKᵢ ∥ Sᵢ)
CTᵢ = Pᵢ ⊕ KSᵢ[:len(Pᵢ)]
Sᵢ₊₁ = SHA-512(Sᵢ ∥ CTᵢ ∥ Cᵢ)
TAG = HMAC-SHA-512(K, S_final ∥ N)