Classical hardness of learning with errors
On ideal lattices and learning with errors over rings