According to https://crypto.stackexchange.com/a/8800/53007:
Start with the entire domain [M] and range [N]. Call y←N/2 our range gap. Now using our key k we generate some pseudorandom coins and give them to our HGD sampling routine along with y, M, and N. This gives us an x≤y that describes the number of points of our order-preserving function less than y.
What does the HGD sampling does exactly? It gives me a "good" or a "bad" ball at random? How can this give me any information about the number of points less than y?
