I'm new to lattices. According to Lattice Signatures and Bimodal Gaussians in the Rejection Sampling section. In Schnorr, GQ you can simply commit to $y$, use it to hide a secret key $s$. But this doesn't work in lattices. You need to hide the secret key with a small $y$. Turns out, a lot of old lattice-based signatures leaked a part of the secret keys. Instead, we must choose y from a narrow distribution and then perform rejection sampling so that $s$ is not leaked when we add $y$ to it.
- What does there mean to be a narrow distribution?
- What does it mean for $y$ to be small?
- Why is this a problem in lattices specifically?