if this problem is difficult to solve, then the signature scheme will be difficult to forge. [see the wikipedia article on ring learning with errors or ideal lattice cryptography for more details on the theoretical difficulty of this problem]