H = HASH(r_c | r_s);

K_EXP_MAC | K_EXP_ENC = KEG(d_s, Q_eph, H).