http://i3xi5qxvbrngh3g6o7czwjfxwjzigook7zxzjmgwg5b7xnjcn5hzciad.onion/proposals/269-hybrid-handshake.html
In which case,
EXPAND(seed, context, len) = XOF(seed | context, len)
DH_GEN() -> (x, X):
Diffie-Hellman keypair generation. Secret key x, public key X.
DH_MUL(P,x) -> xP:
Scalar multiplication in the DH group of the base point P by
the scalar x.