In $\mathbb{Z}$, the discrete Gaussian distribution is defined as $D_{Z,s}(x) = \frac{\rho_s(x)}{\rho_s(\mathbb{Z})}, x\in \mathbb{Z}$.

In LWE, $(\overrightarrow{a}, b = \langle \overrightarrow{a}, \overrightarrow{s}\rangle + e)\in \mathbb{Z}_p^n\times \mathbb{Z}_p$, the error $e$ is just sampled by rounding from continuous Gaussian, but in [GPV08], the author said that rounding is not the $D_{\mathbb{Z},s}$, their statistical distance is not negligible($\Omega(1/s^3)$).

The error in LWE is not discrete Gaussian? Or what's the relation between the error in LWE and the $D_{Z,s}$?

  • $\begingroup$ Hello. Could you please tell us where you saw that "$e$ is just sampled by rounding from continuous Gaussian"? $\endgroup$ Apr 24 at 6:08
  • $\begingroup$ In Seal, for BFV and CKKS, the error term $e(x)= e_0 + e_1x + \cdots + e_{N-1}x^{N-1}$, the coefficients $e_i$'s are just sampled by rounding from continuous Gaussian. $\endgroup$ Apr 25 at 1:19
  • $\begingroup$ I'm not sure that whether the LWE and RLWE are different, i.e, the RLWE error could be sampled by rounding, but the LWE could not? $\endgroup$ Apr 25 at 1:20
  • $\begingroup$ The answers to this should address your question: crypto.stackexchange.com/questions/88685/… $\endgroup$ May 19 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.