There's a new password store mechanism, called Sphinx http://webee.technion.ac.il/~hugo/sphinx.pdf which is very nice and protects from device or user compromise. I haven't found any implementations and tried to do my own using curve25519 primitive and libsodium.
There's login phase when user and device do communication and that's where I got stuck, though it looks pretty simple.
I convert hash to a valid curve point x using elligator2. Then scalar multiply it by some random ρ. Then "device" multiplies it by its k.
So, I have β = x * ρ * k.
I'm stuck at the point where I need to do β1/ρ
in Ref10 implementation of curve25519 there's "feInvert" function which I tried to apply to ρ and then scalar-multiply again, but that did not work.