In R-LWE, is there any advantage to generate secret from normal distribution instead of uniform distribution In this quote from Lattice Cryptography for the Internet (page 8), author says that we can use error distribution (the same one that we used to generate error) to generate secret. My question is considering that sampling from normal distribution is costly, is there any advantage to also use normal distribution to generate secret instead of normal approach which is generating secret from uniform distribution. I am just wondering. Is just to prove that if secret is also generated from the same normal distribution, proof works ...

Because it is confusing and it does not make sense, newHope generates secret from distribution (binomial in case of newhope) (page 3) and this key exchange protocol also uses normal distribution to generate secret (page 8).

If I understood it correctly, in LWE only error has to be generated from normal distribution, not the secret. The same goes for R-LWE and R-LWE key exchange. Sampling from normal distribution is costly and we want the error to be close to zero so we can reconcile the key but why secret should be close to zero?


  We now recall the ring-LWE probability distribution and (decisional)
  computational problem. For simplicity and convenience for our
  applications, we present the problem in its discretized, "normal"
  form, where all quantities are from $R$ or $R_q = R/qR$, and the
  secret is drawn from the (discretized) error distribution.
Neither the secret nor the error in Ring-LWE (or LWE) encryption needs to be generated from the normal distribution.  Only to get the tightest security proofs does one care about the "shape" of the distribution.  For practical cryptanalysis, this does not matter -- only the size of the secret (and noise) does.

Having said this, there is an advantage to the normal distribution.  During decryption, terms that look like $\langle s,e\rangle$ (inner product of the secret vector $s$ and error vector $e$) appears in the decryption.  What we want for security is that $s$ and $e$ have large norms.  What we want to avoid decryption errors is that $\langle s,e\rangle$ is small.  And if one wants to have vectors $s$ and $e$ of a particular $l_2$ norm and have their inner-product be as small as possible, then these vectors should be chosen from a normal distribution.  

The binomial distribution is a very good approximation to the normal and is much easier to generate.  This is why it's a good choice for practical applications.   

Edit:
My original answer was incomplete.  Actually, the uniform distribution is just as good as the binomial one if one only cares about the above two properties.  The main advantage of the binomial distribution is that it has more entropy.  This is important to prevent brute force and man-in-the-middle attacks.