def eval(w,t,x,msk,s):
kw = genKw(w,msk,s)<EOL>tTilde = hashG2(t)<EOL>y = pair(x*kw, tTilde)<EOL>return y,kw,tTilde<EOL>
Pythia server-side computation of intermediate PRF output.
@w: ensemble key selector (e.g. webserver ID)
@t: tweak (e.g. user ID)
@x: blinded message (element of G1)
@msk: Pythia server's master secret key
@s: state value from Pythia server's key table
@returns: (y, kw, tTile)
 where: y: intermediate result
        kw: secret key bound to w (needed for proof)
        tTilde: hashed tweak (needed for proof)