Source: https://crypto.stanford.edu/RealWorldCrypto/slides/gueron.pdf