# How to choose Secret Key Distribution **URL:** \ **Category:** FHE Questions\ **Created:** [August 6, 2024, 11:21pm UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477 "2024-08-06T23:21:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![JuriusStep](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@JuriusStep](https://openfhe.discourse.group/u/JuriusStep)\ **Post date:** [August 6, 2024, 11:21pm UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/1 "2024-08-06T23:21:40Z")
There are 3 Secret Key Distributions: GAUSSIAN UNIFORM\_TERNARY SPARSE\_TERNARY Im original paper of CKKS or CKKS RNS there are 3 Distributions too? why do you use for UNIFORM\_TERNARY as default and GAUSSIAN for example? ---
**Author:** ![Caesar](https://yyz1.discourse-cdn.com/flex031/user_avatar/openfhe.discourse.group/caesar/32/63_2.png) [@Caesar](https://openfhe.discourse.group/u/Caesar)\ **Post date:** [August 9, 2024, 5:38pm UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/2 "2024-08-09T17:38:14Z")
In LWE and RLWE, the secret key \mathbf{s} is sampled from a specific distribution over \mathbb{Z}\_q^n. The most secure distribution is uniform at random from \mathbb{Z}\_q^n. For efficiency reasons, other distributions are also used, offering a slight advantage to existing attacks but still not leading to a complete breach. These distributions include: 1. Gaussian: \mathbf{s} is sampled randomly from a truncated zero-mean Gaussian distribution with a specified width. 2. Uniform Binary: \mathbf{s} is uniformly sampled randomly from the set \{0, 1\}. 3. Uniform Ternary: \mathbf{s} is uniformly sampled randomly from the set \{-1, 0, 1\}. 4. Sparse Ternary: \mathbf{s} is uniformly sampled from \{-1, 0, 1\} but with a specified Hamming weight that determines the number of non-zero coefficients in \mathbf{s}. The sparse ternary distribution is the most efficient, particularly in bootstrapping operations. In terms of security, these distributions are ranked from most secure to least secure as follows: uniform over \mathbb{Z}\_q^n, Gaussian, uniform binary, uniform ternary, and sparse ternary. Despite the differences in security, these distributions are commonly used in the literature. Certain attacks exist for each case and the cryptographic parameters are chosen based on the secret key distribution to provide a specific security level. For more information on this, refer to page 6 in this [work](https://eprint.iacr.org/2024/463.pdf). ---
**Author:** ![Haow\_P](https://avatars.discourse-cdn.com/v4/letter/h/da6949/32.png) [@Haow\_P](https://openfhe.discourse.group/u/Haow_P)\ **Post date:** [January 11, 2025, 11:28am UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/3 "2025-01-11T11:28:26Z")
I’m wondering if I set SecretKeyDist = SPARSE\_TERNARY and SetSecurityLevel(HEStd\_128\_classic), will the parameters still have 128-bit security? ---
**Author:** ![Caesar](https://yyz1.discourse-cdn.com/flex031/user_avatar/openfhe.discourse.group/caesar/32/63_2.png) [@Caesar](https://openfhe.discourse.group/u/Caesar)\ **Post date:** [January 13, 2025, 3:04pm UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/4 "2025-01-13T15:04:43Z")
As for the current state of art on this topic, the answer is yes. Further details can be found [here](https://eprint.iacr.org/2024/463.pdf). ---
**Author:** ![ypolyakov](https://yyz1.discourse-cdn.com/flex031/user_avatar/openfhe.discourse.group/ypolyakov/32/47_2.png) [@ypolyakov](https://openfhe.discourse.group/u/ypolyakov)\ **Post date:** [January 17, 2025, 11:02pm UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/5 "2025-01-17T23:02:34Z")
The security guidelines document (as well as the prior 2018 [HomomphicEncryption.org](http://HomomphicEncryption.org) standards document) currently provides tables only for ternary uniform and Gaussian secrets. The tables for sparse secrets are not available yet (there is an open initiative to write a SoK and estimator for these). So OpenFHE by default uses the tables for uniform ternary secrets (also for sparse secrets). Note that sparse secrets should be used with care (only in research settings so far). ---
**Author:** ![YingjieDong1](https://avatars.discourse-cdn.com/v4/letter/y/e56c9b/32.png) [@YingjieDong1](https://openfhe.discourse.group/u/YingjieDong1)\ **Post date:** [September 8, 2025, 6:50am UTC](https://openfhe.discourse.group/t/how-to-choose-secret-key-distribution/1477/6 "2025-09-08T06:50:32Z")
Hi, Sir. The offered document seems not to implement it when s is chosen from uniform distribution. I’m wondering if I could set smaller parameters compared with other types.