code: func (s *SecureChannelSession) Pair(pairingPassword []byte) error {
  	secretHash := pbkdf2.Key(norm.NFKD.Bytes(pairingPassword), norm.NFKD.Bytes([]byte(pairingSalt)), 50000, 32, sha256.New)
  
  	challenge := make([]byte, 32)
  	if _, err := rand.Read(challenge); err != nil {
  		return err
  	}
  
  	response, err := s.pair(pairP1FirstStep, challenge)
  	if err != nil {
  		return err
  	}
  
  	md := sha256.New()
  	md.Write(secretHash[:])
  	md.Write(challenge)
  
  	expectedCryptogram := md.Sum(nil)
  	cardCryptogram := response.Data[:32]
  	cardChallenge := response.Data[32:64]
  
  	if !bytes.Equal(expectedCryptogram, cardCryptogram) {
  		return fmt.Errorf("Invalid card cryptogram %v != %v", expectedCryptogram, cardCryptogram)
  	}
  
  	md.Reset()
  	md.Write(secretHash[:])
  	md.Write(cardChallenge)
  	response, err = s.pair(pairP1LastStep, md.Sum(nil))
  	if err != nil {
  		return err
  	}
  
  	md.Reset()
  	md.Write(secretHash[:])
  	md.Write(response.Data[1:])
  	s.PairingKey = md.Sum(nil)
  	s.PairingIndex = response.Data[0]
  
  	return nil
  }
docs: // Pair establishes a new pairing with the smartcard.