d_eph is chosen from {1, ... , q_s - 1} at random;

Q_eph = d_eph * P_s.