Initial Setup:

$\mathrm{\Delta }\text{ is a plaintext scaling factor for polynomial encoding},S\underset{}{\overset{\$}{\leftarrow }}{R}_{⟨n,2⟩}$. The coefficients of the polynomial $S$ can be either binary (i.e., $\{0,1\}$) or ternary (i.e., $\{-1,0,1\}$).

Encryption Input: $\mathrm{\Delta }M\in R_{⟨n,q⟩}$, $A_i\underset{}{\overset{\$}{\leftarrow }}{R}_{⟨n,q⟩}$, $E\underset{}{\overset{{\xi }_{\sigma }}{\leftarrow }}{R}_{⟨n,q⟩}$

1.

Compute $B=-A\cdot S+\mathrm{\Delta }M+E\in R_{⟨n,q⟩}$

2.

${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)=(A,B)\in R_{⟨n,q⟩}^2$

Decryption Input: $\mathsf{\text{𝖼𝗍}}=(A,B)\in R_{⟨n,q⟩}^2$

${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }^{-1}(\mathsf{\text{𝖼𝗍}})={\lceil {\displaystyle \frac{B+A\cdot Smodq}{\mathrm{\Delta }}}\rfloor }_{\frac{1}{\mathrm{\Delta }}}={\lceil {\displaystyle \frac{\mathrm{\Delta }M+E}{\mathrm{\Delta }}}\rfloor }_{\frac{1}{\mathrm{\Delta }}}\approx M$

# $\lceil x{\rfloor }_k$ means rounding $x$ to the nearest multiple of $k$

Property of Approximate Decryption:

• Unlike BFV, CKKS’s each plaintext value $m_i$ is originally not in a modulus ring, but a real number with infinite decimal digits. Therefore, it’s not possible to exactly decrypt the ciphertext to the same original value.
• If each coefficient of the noise $E$ is smaller than ${\displaystyle \frac{\mathrm{\Delta }}{2}}$, then the decryption ensures the precision level with the multiple of ${\displaystyle \frac{1}{\mathrm{\Delta }}}$.