Better Zero-Knowledge Proofs for Lattice Encryption and Their Application to Group Signatures
Candidate multilinear maps from ideal lattices