diff --git a/src/shamira/gf256.py b/src/shamira/gf256.py
--- a/src/shamira/gf256.py
+++ b/src/shamira/gf256.py
@@ -41,12 +41,13 @@ def gfmul(a, b):
 def evaluate(coefs, x):
 	"""Evaluate polynomial's value at x.
 
-	:param coefs: [a0, a1, ...]."""
+	:param coefs: [an, ..., a1, a0]."""
 	res = 0
-	xk = 1
-	for a in coefs:
-		res ^= gfmul(a, xk)
-		xk = gfmul(xk, x)
+
+	for a in coefs:  # Horner's rule
+		res = gfmul(res, x)
+		res ^= a
+
 	return res