codecrypt/doc/papers/PQC-S2.pdf