D-3.6 Ciphertext-to-Plaintext Multiplication

Remember that BFV’s ciphertext-to-plaintext multiplication (§D-2.6) is performed as follows:

${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)\cdot \mathrm{\Lambda }$

$=(A,B)\cdot \mathrm{\Lambda }$

$=(A\cdot \mathrm{\Lambda },B\cdot \mathrm{\Lambda })$

$={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M\cdot \mathrm{\Lambda }))$

, where the plaintext polynomial $\mathrm{\Lambda }$ is not scaled by $\mathrm{\Delta }$. However, the above relation cannot be used in CKKS’s ciphertext-to-plaintext multiplication because when CKKS encodes the input vector slots into polynomial coefficients, the encoding is computed as $\overrightarrow{m}={\displaystyle \frac{\tilde{W}\cdot I_n^R\cdot {\overrightarrow{v}}_{{}^{\prime }}}{n}}$ (Summary D-3.1 in §D-3.1), where the $n$-th root-of-unity base $\omega =e^{\mathit{𝑖𝜋}∕n}=\cos <!--\; FUNCTION\; APPLICATION\; -->\left({\displaystyle \frac{\pi }{n}}\right)+i\sin <!--\; FUNCTION\; APPLICATION\; -->\left({\displaystyle \frac{\pi }{n}}\right)$. Since $\omega$ is usually not an integer, the encoded polynomial $\mathrm{\Lambda }$’s coefficients are usually not integers (will usually have infinite decimal digits). Therefore, we need to follow the CKKS encoding procedure’s last step (Summary D-3.1 in §D-3.1), which scales $\mathrm{\Lambda }$ by $\mathrm{\Delta }$ to shift an enough number of its decimal values to the integer digits, which effectively approximates the decimal coefficients to integers with high precision. Then, the resulting encrypted plaintext becomes $\mathrm{\Delta }M\cdot \mathrm{\Delta }\mathrm{\Lambda }={\mathrm{\Delta }}^{2}M\mathrm{\Lambda }$. To convert ${\mathrm{\Delta }}^{2}M\mathrm{\Lambda }$ into $\mathrm{\Delta }M\mathrm{\Lambda }$, we need to do a rescaling operation as we did in CKKS’s ciphertext-to-ciphertext multiplication’s (Summary D-3.5.6 in §D-3.5.6) last step. Therefore, CKKS’s ciphertext-to-plaintext multiplication consumes one multiplicative level (whereas BFV’s ciphertext-to-plaintext multiplication does not consume any multiplicative level). CKKS’s ciphertext-to-plaintext multiplication is summarized as follows: