Source: https://www.di.ens.fr/~nitulesc/files/CRYPTO13/TD2.pdf