H = HASH(r_c | r_s);

K_EXP = KEG_28147(d_s, Q_eph, H).