Summary and Conclusions I In any cyclotomic ring, Ring-LWE is pseudorandom if ideal lattice problems are (quantumly) hard in the worst case. I Ring-LWE allows for much more compact and efficient encryption schemes than standard LWE. E.g., PKE in