low - cost and area - efficient fpga implementations of lattice - based cryptography .
Fiat-Shamir with aborts: Applications to lattice and factoring-based signatures