# Lattice-based cryptography: secret from Gaussian distribution chi

In a lecture, by Chris Peikert (link 40:20), he showed more efficient cryptosystems that have the secret be drawn from the Gaussian error distribution $$\chi$$. In the lecture he said "some applications which really really need secrets to come from the error distribution and they don't really work so well if they come from uniform distribution" and he adds "for some strange reason this is the form is what gets you further in terms of building applications like Full Homomorphic Encryption (FHE)".

1. Do we know today why this is the case?
2. What efficiency does error distribution bring over a uniform one?

Edit: update the information

• Are you sure he said the application only worked with Gaussian secret or the requirement is that the secret has small norm? Maybe you should check this, because some FHE schemes work well when the secret is short, but "short" can be Gaussian, binary, ternary... Sep 10 '21 at 11:35
• Sorry for the late reply I was trying to find where I heard that. So it wasn't from Vadim Lyubashevsky but Chris Peikert during a Winter School. I will update by question with link to the lecture. Sep 14 '21 at 12:56

• The LWE with binary secrets is also proven to be secure, you just have to increase the dimension $n$. However, I think that there is no worst-case to average-case reduction for the RLWE with binary or ternary secrets, but people use it anyway, like in HElib or TFHE, since it is still possible to estimate concrete security for such secrets and they are even shorter than when the distribution is Gaussian... Sep 15 '21 at 11:45