H = HASH(r_c | r_s);

K_EXP = KEG_28147(d_eph, Q_s, H).