Discrete Ziggurat: A Time-Memory Trade-Off for Sampling from a Gaussian Distribution over the Integers

Abstract

Abstract. Several lattice-based cryptosystems require to sample from a discrete Gaussian distribution over the integers. Existing methods to sample from such a distribution either need large amounts of memory or they are very slow. In this paper we explore a different method that allows for a flexible time-memory trade-off, offering developers freedom in choosing how much space they can spare to store precomputed values. We prove that the generated distribution is close enough to a discrete Gaussian to be used in lattice-based cryptography. Moreover, we report on an implementation of the method and compare its performance to existing methods from the literature. We show that for large standard deviations, the Ziggurat algorithm outperforms all existing methods.

On Practical Discrete Gaussian Samplers for Lattice-Based Cryptography

“…Discrete Ziggurat sampling is adapted by Buchmann et al [4] from an original method of continuous Ziggurat sampling, proposed by Marsaglia and Tsang [22]. It is an optimised form of rejection sampling, which divides the area under the curve into several rectangles (REC NUM ) of equal area, where the left hand side of each rectangle is aligned with the y-axis and the right hand side of each rectangle aligns with the curve of the discrete Gaussian distribution.…”

“…Currently, there are no hardware implementations of this sampler. However, Buchmann et al [4] propose a C++ implementation with several optimisations, depicted in Algorithm 5, and also a comparison of discrete Ziggurat with alternative sampling methods to show that this method is suitable for use when large standard deviations are required. In discrete Ziggurat sampling [4], firstly a random value, x, is generated and then x is checked for cases when x equals zero or lies comfortably within a given rectangle (i.e.…”

“…Otherwise, the sample is found to lie close to the curve and further calculations are required to establish whether x is above or below this curve (see lines 10 onwards in Algorithm 5). Algorithm 5 Discrete Gaussian Sampling using Discrete Ziggurat [4] Require: The number of rectangles, m, the lower right corners of rectangles ( xi , yi ) for i ∈ m, precision λ;…”

“…Note thatȳ i are stored in STORE Y. Then,ȳ is used within three inequalities to decide whether to reject the sample x, that is, to decide in which part of the rectangle the randomly generated integer x lies (as seen in Algorithm 5). For further details see the original proposed algorithm and software design by Buchmann et al [4].…”

“…This research proposes practical and time-independent hardware implementations of all discrete Gaussian samplers used in lattice-based encryption and signature schemes 1 , that is, the Bernoulli sampler [10], the cumulative distribution table (CDT) sampler [26], the Knuth-Yao sampler [17], and the discrete Ziggurat sampler [22], [4]. The major contributions of this research are as follows:…”