code: private byte[] getClientProof() {
          byte[] clientKey = hmac(saltedPassword, CLIENT_KEY);
          byte[] storedKey = digest.digest(clientKey);
          byte[] clientSignature = hmac(storedKey, getAuthMessage().getBytes());
  
          xor(clientKey, clientSignature);
          return clientKey;
      }
docs: Generate the Client Proof. It is computed as:
  <p></p>
  SaltedPassword  := Hi(Normalize(password), salt, i)
  ClientKey       := HMAC(SaltedPassword, "Client Key")
  StoredKey       := H(ClientKey)
  AuthMessage     := client-first-message-bare + "," +
  server-first-message + "," +
  client-final-message-without-proof
  ClientSignature := HMAC(StoredKey, AuthMessage)
  ClientProof     := ClientKey XOR ClientSignature