Fix typo.

The problem was pointed out by Yawning Angel in:
<https://bugs.torproject.org/10893#comment:3>
Fix problems in UniformDH spec.

1. Fix a typo by changing "X" to "Y".
2. Add "M_C" and "M_S" to the respective MAC function as they are also
   authenticated.

The problem was pointed out by Yawning Angel in:
<https://bugs.torproject.org/10893>
Let the server echo the epoch.

There's no need for the server to determine its own epoch.
Make the server simply echo the client's epoch.

That's only relevant for UniformDH.
When authenticating, also test epoch boundaries.

On occasion, a client's or a server's epoch might already have increased
whereas the epoch of the other party didn't.  This is a benign event and there
is no reason to fail authentication because of this.  As a result, as a server,
we now also test boundary values, i.e., epoch - 1, epoch, epoch + 1.
Add missing reference.
Fix ticket handshake spec.

The first message makes use of the HMAC key which is derived from the master
key.  It does not use the master key itself.
Elaborate on protocol polymorphism.

While the general idea is explained, there are no exact details.
Implementations may use different (CS)PRNGs to derive probability
distributions.  Such "flow diversity" might even be beneficial.
Add recent changes to ChangeLog.
Add missing markers to HMACs.

Thanks to Yawning Angel for catching this.
Merge branch 'bug_10893'

Conflicts:
	unittests.py