Having recently written about post quantum encryption, and why it means that public key encryption will not die with the advent of quantum computers, I realise from many comments I received that I need to clarify something. "Quantum resistant" does not mean "quantum proof".
One particular comment I received pointed out that although some elements of some implementations of lattice encryption were not subject to attacks using Shor's algorithm, Grover's algorithm might still apply. In particular if you consider the BLISS Ring-LWE Signature Scheme , Grover's algorithm can be used to mount an attack against the random oracle element of the scheme (if you want t o play with the original implementation of BLISS it can be found here). You can see from the original implementation that that oracle is such that it is not collision resistant. Hence conducting a preimage search would be a suitable for, of attack, and preimage searches (using such as Grover's algorithm) are just what quantum computers are good at.
