# Discrete Gaussian Sampling in Authenticated key exchange from ideal lattices

I am implementing the key exchange scheme proposed by zhang et al. on Sage. In the implementation of the scheme, they have used the two distributions $\chi_{\alpha}, \chi_{\beta}$.

How to choose $\alpha, \beta$ and what should be typical values of $\alpha\ and \ \beta$ to have 100% correctness of the scheme (that is alice and bob will have same shared session key?

The second confusion is that on page number 12, (where the protocol is defined) they have done the rejection sampling and provide steps to do this. In this they state that repeat the step 1~3 with probability $1-min(\frac{\mathcal{D}_{\mathcal{Z}^{2n},_\beta}(z)}{\mathcal{D}_{\mathcal{Z}^{2n},_\beta,_z1}(z)} ,1)$. See the the highlighted image bellow:

How to define M with respect to $\alpha \ and \ \beta$ and use the above probability condition to apply the repeat condition through step 1~3?

• just skimmed the article (took less than 1 minute). Parameters are given in chapter 6. – user27950 Jun 18 '18 at 5:07
• I do not understand how they have chosen these parameters. Thanks – vivek Jun 18 '18 at 5:10
• then you have do dig through the paper and state sone more specific questions. – user27950 Jun 18 '18 at 17:22
• I just want to point out that the approach in this paper is a very inefficient way to do lattice-based AKE. The more efficient, and simpler, approach is via a (folklore) generic transformation from a CPA-secure PKE scheme. For an example of how it is used, you can look at Section 5 of eprint.iacr.org/2017/634.pdf and for a formal security proof in the QROM, there is a recent paper: eprint.iacr.org/2018/928.pdf (for a longer discussion of this issue, you can also take a look at eprint.iacr.org/2016/461.pdf) – Vadim L. Nov 9 '18 at 9:01