Source: https://iacr.org/archive/crypto2001/21390309.pdf