Gaussian width in lattice setting

Question

In the lattice setting (like LWE, RLWE) , the Gaussian function is often defined as $$ \rho_{\Sigma}(x) = e^{-\pi x^T\Sigma^{-1}x} $$ The discrete Gaussian distribution $\mathcal{D}_{\Lambda, \Sigma}$ on lattice $\Lambda$ of dimension $n$ with densitiy proportional to $\rho_{\Sigma}$ restricted to $\Lambda$ has covariance $\Sigma / (2\pi)$. Is there a reason to not choose $\rho$ in a way that $\mathcal{D}_{\Lambda, \Sigma}$ has covariance $\Sigma$? (e.g. by changing $-\pi$ to $-1/2$)

Especially, does the lemma (e.g. Lemma 2.8 in A toolkit for Ring-LWE Cryptography) $$ Pr[||x|| > r\sqrt{n} \ | \ x \leftarrow \mathcal{D}_{\Lambda, r^2I_n}] \text{ is neglible in n} $$ still hold, if $\rho$ is defined as $\rho_{\Sigma}(x) = e^{- x^T\Sigma^{-1}x /2}$?

Edit: Corrected the Lemma to have $r^2$ as index

Answer 1

The choice of $-\pi$ vs $-1/2$ both doesn't matter (one can simply scale $\Sigma$ to accommodate for it), and actually is a convention that did not initially appear in lattice cryptography. Roughly speaking, when working with Gaussian-like functions $\exp(-cx^2)$, there are two choices of parameterizations that are common in mathematics.

• Physicist's: Here, you choose $\exp(-c\pi x^2)$. This is done so that the "obvious" Fourier transform ($\mathcal{F}[f](\eta)= \int_\mathbb{R} f(x)\exp(2\pi i x\eta)d\mathrm{x}$) has nicer properties, for example is Unitary/its own inverse, without requiring an ugly normalization factor.

• Statistician's: Here, you choose $\exp(-cx^2/2)$. This is done so the Standard Normal (under this normalization) has variance $1/c$, nicer than one would have with the $\pi$-based normalization.

An easy reference for the existence of this cultural difference is the wikipedia page on the Hermite polynomials, which includes sections on each normalization.

With that background,

The discrete Gaussian distribution $D_{\Lambda,\Sigma}$ on lattice $\Lambda$ of dimension $n$ with density proportional to $\rho_\Sigma$ restricted to $\Sigma$ has covariance $\Sigma/(2\pi)$.

I don't think that is true. The discrete Gaussian has strictly smaller variance than the corresponding continuous Gaussian of the same parameter, see Prop. 21 of "The Discrete Gaussian for Differential Privacy".

Is there a reason to not choose $\rho$ in a way that $D_{\Lambda,\Sigma}$ has covariance $\Sigma$?

If you agree with physicist's (perhaps due to making many Fourier-theoretic arguments)/use their reference materials more, mainly. The choice doesn't really matter, and as mentioned before the Statistician's argument here is mildly weaker as $\mathsf{Cov}[D_{\Lambda, \Sigma}]\neq \Sigma$ under either choice of normalization.

Especially, does Lemma 2.8 still hold, if $\rho$ is defined as $\rho_\Sigma(x) = \exp(-x^t\Sigma^{-1}x/2)$?

It does. You'll get that

$$ \Pr[\lVert x\rVert > cr\sqrt{n}\mid x\gets D'_{\Lambda, rI_n}]\text{ is negligible in }n $$ where $D'$ is the discrete Gaussian with your chosen normalization, and $c$ is some scaling factor to convert between the two normalizations. Imagine the initial bound was $\leq \exp(-n)$ (something like this is probably true). Iirc (and this is not hard to show at all, I am just being lazy), the bound in the other normalization is then something like $\exp(-n/c)$. So still negligible in $n$, though mildly different if one cares about concrete numbers.