A Usable, Secure Communications Protocol: Client-Side TLS - Implementing SSL/TLS Using Cryptography and PKI - page 332

Notice that the secret and the seed are constant throughout each HMAC
operation; the only difference in each are the A values. These operations produce
the 48 output bytes:

0x1b6ca10d18faddfbeb92b2d95f55ce2607d6c81ebe4b96d
1bec81813b9a0275725564781eda73ac521548d7d1f982c17

P_SHA1 is identical. It just replaces the SHA-1 hash algorithm with the MD5
hash algorithm. Because SHA-1 produces 20 bytes of output per iteration, though,
it's only necessary to iterate twice and none of the output is discarded. P_SHA
is fed the exact same seed, but only the last half of the secret, as diagrammed
in Figure 6-9.

secret( “cd” )

HMAC_SHA A(1) HMAC_SHA A(2)

seed( “efghijkl” )

seed( “efghijkl” )

HMAC_SHA HMAC_SHA

secret( “cd” )

output

Figure 6-9: P_SHA1

This produces the 40 bytes:
0xcbb3de5db9295cdb68eb1ab18f88939cb3146849fe167cf8f9ec5f131790005d7f27b
2515db6c590

Finally, these two results are XORed together to produce the 40-byte pseudo-
random combination:
0xd0df7f50a1d381208379a868d0dd5dbab4c2a057405dea2947244700ae30270
a5a71f5d0b011ff55

Notice that there's no predictable repetition here, and no obvious correlation
with the input data. This procedure can be performed to produce any arbitrarily