In this quote from Lattice Cryptography for the Internet (page 8), author says that we can use error distribution (the same one that we used to generate error) to generate secret. My question is considering that sampling from normal distribution is costly, is there any advantage to also use normal distribution to generate secret instead of normal approach which is generating secret from uniform distribution. I am just wondering. Is just to prove that if secret is also generated from the same normal distribution, proof works ...
Because it is confusing and it does not make sense, newHope generates secret from distribution (binomial in case of newhope) (page 3) and this key exchange protocol also uses normal distribution to generate secret (page 8).
If I understood it correctly, in LWE only error has to be generated from normal distribution, not the secret. The same goes for R-LWE and R-LWE key exchange. Sampling from normal distribution is costly and we want the error to be close to zero so we can reconcile the key but why secret should be close to zero?
We now recall the ring-LWE probability distribution and (decisional) computational problem. For simplicity and convenience for our applications, we present the problem in its discretized, "normal" form, where all quantities are from $R$ or $R_q = R/qR$, and the secret is drawn from the (discretized) error distribution.