Why is the vector sampled from Gaussian or Subgaussian distribution in lattice-based cryptography? I have known that the vector is sampled from Gaussian distribution in lattice-based cryptography because the distribution of the vector $\mod{\mathcal{P}(\mathbf{B})}$ approximates to uniform distribution.

It is proved by below lemma.


  For any $s &gt; 0$, $\mathbf{c} \in \mathbb{R}^n$, and lattice $\Lambda(\mathbf{B})$, the statistical distance between $\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})}$ and the uniform distribution over $\mathcal{P}(\mathbf{B})$ is at most $\frac{1}{2} \rho_{1/s}(\Lambda(\mathbf{B})^*\backslash\{\mathbf{0}\})$. In particular, for any $\epsilon &gt;0$ and any $s \geq \eta_{\epsilon}(\mathbf{B})$, the statistical distance is at most $\Delta(\mathcal{D}_{s,\mathbf{c}} \mod{\mathcal{P}(\mathbf{B})},\mathcal{U}(\mathcal{P}(\mathbf{B}))) \leq \epsilon/2$.


But if the vector is sampled from uniform distribution at first, the distribution of the vector $\mod{\mathcal{P}(\mathbf{B})}$ is uniform. So, I thought that Gaussian sampling is not needed for above reason, because Gaussian sampling requires large costs.

Another reason I think is that the smaller vector is preferred because almost lattice problem is about finding short vector and Gaussian variable has higher probability as closer to the center. Is it right?

If my thought is not correct, let me know the reason using Gaussian distribution in lattice-based cryptography.
You can't directly sample uniformly modulo a lattice unless you know what the lattice is. The Gaussian distribution can be sampled independently of knowledge of the lattice. This distinction is important in situations where the lattice is part of a cryptographic secret.