Source: https://web.eecs.umich.edu/~cpeikert/pubs/slides-exponent-tcc.pdf