Abstract Almost all practically relevant asymmetric cryptosystems like RSA or ECC are either based on the hardness of factoring or on the hardness of the discrete logarithm problem. However, both problems could be solved efficiently on a large enough quantum computer. While quantum computers powerful enough to break currently used parameter sets are not available yet, they are heavily researched and expected to reach maturity in 15 to 20 years. As a consequence, research on alternative quantum-safe cryptosystems is required. One alternative is lattice-based cryptography which allows the construction of asymmetric public-key encryption and signature schemes that offer a good balance between security, performance, and key as well as ciphertext sizes.