Sampling Discrete Gaussians Efficiently and Obliviously

In this work we construct an algorithm for sampling Discrete Gaussians efficiently and obliviously. Previously discrete Gaussian samplers have been constructed in [GPV08, Pei10], where the algorithms take as input a “high quality” basis and produce an output whose quality depends on the input basis quality. Our algorithm produces a discrete Gaussian of somewhat worse quality than [GPV08, Pei10] but with the advantage that it does not require access to an explicit description of the underlying lattice, for example it suffices for our purposes to have encryptions of lattice vectors under an additively homomorphic encryption scheme. At the heart of our work is the fundamental question how do sums of discrete Gaussians behave? Unlike their continuous counterparts, discrete Gaussians are not that well understood. We believe that our work fills in some important gaps of this understanding. Our results are already important in enabling the exciting new work on multilinear maps [GGH12], and since the questions we resolve arise naturally, we believe that our work will find application in other areas as well. The second and third authors were supported by the Intelligence Advanced Research Projects Activity (IARPA) via Department of Interior National Business Center (DoI/NBC) contract number D11PC20202. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright annotation thereon. Disclaimer: The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of IARPA, DoI/NBC, or the U.S. Government. ∗UCLA. Email: shweta@cs.ucla.edu †IBM Research. Email: craigbgentry@gmail.com ‡IBM Research. Email: shaih@alum.mit.edy §UCLA. Email: sahai@cs.ucla.edu.