Can homomorphic encryption be practical?
Worst-Case to Average-Case Reductions Based on Gaussian Measures