def eval(w,t,x,msk,s):
    """
    Pythia server-side computation of intermediate PRF output.
    @w: ensemble key selector (e.g. webserver ID)
    @t: tweak (e.g. user ID)
    @x: blinded message (element of G1)
    @msk: Pythia server's master secret key
    @s: state value from Pythia server's key table
    @returns: (y, kw, tTile)
     where: y: intermediate result
            kw: secret key bound to w (needed for proof)
            tTilde: hashed tweak (needed for proof)
    """
    # Construct the key
    kw = genKw(w,msk,s)

    # Multiply x by kw (it's fastest this way), hash the tweak, and compute
    # the pairing.
    tTilde = hashG2(t)
    y = pair(x*kw, tTilde)
    return y,kw,tTilde