https://crypto.ethz.ch/publications/files/CraSho98.pdf

... ffflfiflffi! "# ff%$ &'ffi)(*+ , -.)/#' +0*1 32 " 4657+fifl 8(* :9#ffi! ;%2 < =fi9#%ff>?@A ...