1
$\begingroup$

In $\mathbb{Z}$, the discrete Gaussian distribution is defined as $D_{Z,s}(x) = \frac{\rho_s(x)}{\rho_s(\mathbb{Z})}, x\in \mathbb{Z}$.

In LWE, $(\overrightarrow{a}, b = \langle \overrightarrow{a}, \overrightarrow{s}\rangle + e)\in \mathbb{Z}_p^n\times \mathbb{Z}_p$, the error $e$ is just sampled by rounding from continuous Gaussian, but in [GPV08], the author said that rounding is not the $D_{\mathbb{Z},s}$, their statistical distance is not negligible($\Omega(1/s^3)$).

The error in LWE is not discrete Gaussian? Or what's the relation between the error in LWE and the $D_{Z,s}$?

Improve this question
$\endgroup$
4
  • $\begingroup$ Hello. Could you please tell us where you saw that "$e$ is just sampled by rounding from continuous Gaussian"? $\endgroup$
    – Hilder Vitor Lima Pereira
    Commented Apr 24, 2021 at 6:08
  • $\begingroup$ In Seal, for BFV and CKKS, the error term $e(x)= e_0 + e_1x + \cdots + e_{N-1}x^{N-1}$, the coefficients $e_i$'s are just sampled by rounding from continuous Gaussian. $\endgroup$
    – Bob
    Commented Apr 25, 2021 at 1:19
  • $\begingroup$ I'm not sure that whether the LWE and RLWE are different, i.e, the RLWE error could be sampled by rounding, but the LWE could not? $\endgroup$
    – Bob
    Commented Apr 25, 2021 at 1:20
  • $\begingroup$ The answers to this should address your question: crypto.stackexchange.com/questions/88685/… $\endgroup$
    – Chris Peikert
    Commented May 19, 2021 at 0:54

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.