anchor.diff:      (ironclad:derive-key kdf password salt 0 *key-length*)))
   
   (defun seed (master-key site-name site-counter)
  +  (declare (octets master-key) (string site-name) (int32 site-counter))
     (let ((hmac (ironclad:make-hmac master-key :sha256)))
       (ironclad:update-hmac hmac (string->octets *password-scope*))
       (ironclad:update-hmac hmac (int32->octets (length site-name)))
  
positive.code: 
  (deftype octet () '(unsigned-byte 8))
  (deftype octets () '(vector octet))
  
  (defun string->octets (string)
    (babel:string-to-octets string))
  
  (defun int32->octets (value)
    (ironclad:integer-to-octets value :n-bits 32))
  
  (defun master-key (full-name master-password)
    (let ((salt (concatenate 'octets
                             (string->octets *password-scope*)
                             (int32->octets (length full-name))
  
negative.code:     (ironclad:hmac-digest hmac)))
  
  (defun template (seed type)
    (declare (octets seed) (template-type type))
    (let ((candidates (cdr (assoc type *templates* :test #'eq))))
      (aref candidates (mod (aref seed 0) (length candidates)))))
  
  (defun password-character (class seed-byte)
    (declare (character class) (octet seed-byte))
    (let ((choices (cdr (assoc class *password-characters*))))
      (aref choices (mod seed-byte (length choices)))))
  
  (defun password (seed type)
    (declare (octets seed) (template-type type))
    (coerce (loop for c across (template seed type)
                  for i from 1
                  collect (password-character c (aref seed i)))
  