Can homomorphic encryption be practical?
On ideal lattices and learning with errors over rings