Shanks–Tonelli algorithm