I am new to Ring-LWE. I had assumed that error distribution in Ring-LWE (or, in any lattice-based cryptography) is always Gaussian.

However, while reading a few research papers (e.g. page 5, Section "Noise distribution and reconciliation" in https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_alkim.pdf), it looks like we can sample coefficients of error polynomial $e$, $e'$, $e''$ from Binomial or Uniform or any other distribution as well as long as the deviation is small.

Can someone please explain how we should choose error distribution?

EDIT: Watch this video on "The Mathematics of Lattices II" by Vinod Vaikuntanathan (MIT) - (between 32:50 and 34:40 where he discusses about error distribution) https://www.youtube.com/watch?v=SZkTJMorxnM


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.