Cramer-Shoup system