# Hardware Gaussian random numbers for lattice-based cryptography

I read that a key aspect of such protocols rely on added Gaussian noise on lattices, and which therefore require highly efficient and constant-time Gaussian samplers, which appears to need non-trivial algorithms. For what I got this is still something that could be improved in lattice-based cryptography.

I know that there are hardware random number generators that naturally produce Gaussian distributions. For example, thermal electronic noise from active and passive components often shows Gaussian behaviour. Also some optical random number generators are known to produce unpredictable and normally distributed random numbers.

My question is: could Gaussian hardware random number generators play a role in adding the Gaussian noise required for the security of lattice-based cryptography?

Or is there something fundamental that I am missing about how these Gaussian sampler must be built? Perhaps related to the choice of the standard deviation? Or because some determinism is preferred?

Any help in understanding this would be helpful, and also any instruction to where to find a good, (simple :-D ) introduction to Gaussian sampling in lattice-based cryptography.

I am very new to the field, so forgive me if I said anything imprecise or incorrect

Kind Regards, Rafa

You are confusing discrete Gaussian sampling with Gaussian sampling. A discrete Gaussian of parameters $$\mu, \sigma$$ is a random variable supported on $$\mathbb{Z}$$ with pmf: $$\Pr[X = k]\propto \exp(-\pi \|x-\mu\|^2/\sigma^2)$$ A continuous Gaussian of parameters $$\mu, \sigma$$ is a random variable supported on $$\mathbb{R}$$ with pdf: $$\Pr[X = r] \propto\exp(-\pi \|x - \mu\|^2/\sigma^2)$$ One natural hope would be that discrete Gaussians are simply "Continuous Gaussians rounded to the nearest integer". This is not the case (one is left with two distributions which, while similar, are not identical. One particular difference is that I don't believe the sum of two rounded Gaussians is rounded Gaussian, but under suitable restrictions this holds for discrete Gaussians). That being said one can adapt certain proofs to use "rounded Gaussians", which this paper by Hulsing et al. does.