Source: https://www.math.u-bordeaux.fr/~jcerri/crypto13/dscrypto2014.pdf