Bakko wrote:


> I understand there is (1) a wrapper and (2) a payload.
> Where does it keep the routine for testing the user-entered key?


The routine is in the wrapper, the value to check against is considered as
payload. Typically a salted hash to check for key pretty fast, and then a
keyed MAC for integrity of the rest of the payload.