¹See Menezes et. al., “Handbook of Applied Cryptography”, p. 239–240, for details.