In LPR12, page 4 is described a ring-LWE encryption in which we are working in a ring $R = \mathbb{Z}[x]/(x^n + 1)$ for a $n$ a power of 2. The public key is of the form $(a, b= a\cdot s + e)$ where $s$ is a secret key and $e$ a "small" element sampled form an error distribution. This is then generalized to other cyclotomic polynomials in LPR13.
I am trying to understand how to (efficiently) implement a sampler for e. As it is described, the distribution for $e$ is a discrete (or discretized) Gaussian but in a bit scaled and screwed space. Probably the easiest way to see it is as in CIV16, page 3 where they describe it by a linear transformation of a gauss sample. But implementing it in this way as a matrix multiplication seems inefficient. On the other hand, in papers like RVMCV14 it seems to me that there is no mentioning of any transformation.
I am asking what implementation would be preferred here? Actually I would be more than satisfied with an answer for when $R = \mathbb{Z}[x]/(x^n + 1)$ and $n$ is a power of 2.
