H = HASH(r_c | r_s);

K_EXP_MAC | K_EXP_ENC = KEG(d_eph, Q_s, H).