# Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptography? [duplicate]

I have known that the vector is sampled from Gaussian distribution in lattice-based cryptography because the distribution of the vector $$\mod{\mathcal{P}(\mathbf{B})}$$ approximates to uniform distribution.

It is proved by below lemma.

For any $$s > 0$$, $$\mathbf{c} \in \mathbb{R}^n$$, and lattice $$\Lambda(\mathbf{B})$$, the statistical distance between $$\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})}$$ and the uniform distribution over $$\mathcal{P}(\mathbf{B})$$ is at most $$\frac{1}{2} \rho_{1/s}(\Lambda(\mathbf{B})^*\backslash\{\mathbf{0}\})$$. In particular, for any $$\epsilon >0$$ and any $$s \geq \eta_{\epsilon}(\mathbf{B})$$, the statistical distance is at most $$\Delta(\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})},\mathcal{U}(\mathcal{P}(\mathbf{B}))) \leq \epsilon/2$$.

But if the vector is sampled from uniform distribution at first, the distribution of the vector $$\mod{\mathcal{P}(\mathbf{B})}$$ is uniform. So, I thought that Gaussian sampling is not needed for above reason, because Gaussian sampling requires large costs.

Another reason I think is that the smaller vector is preferred because almost lattice problem is about finding short vector and Gaussian variable has higher probability as closer to the center. Is it right?

If my thought is not correct, let me know the reason using Gaussian distribution in lattice-based cryptography.

• I think it's because one of the original paper written by Regev, the cryptosystem is linked to the LWE problem with a gaussian noise. – Ievgeni Aug 13 '19 at 13:26

• But the algorithms i see use a good basis when they sample vector. In detail, they use the nearest plane algorithm that output the nearest lattice vector from target vector and they output the nearest vector with higher probability than other. (e.g target vector $\mathbf{c}$ is closer lattice vecotr $\mathbf{v}$ than $\mathbf{0}$, the probability outputting $\mathbf{v}$ is larger than $\mathbf{0}$. Can they sample the vector from Gaussian without the basis? Or is the algorithm an exception? Then, why does the algorithm i see sample from Gaussian? – 전소현 Aug 13 '19 at 6:26