Hard Problem Basis
TFHE	LWE
BFV
CKKS	RLWE
BGV

	Unit Data Type
TFHE	Vector
BFV
CKKS	Polynomial
BGV

	Plaintext
TFHE	Number $m\in {\mathbb{Z}}_t$ # $t$ is a power of 2
BFV	Polynomial $M\in {\mathbb{Z}}_t[X]∕X^n+1$ # $t$ is a prime, and $n$ is a power of 2
CKKS	Polynomial $M\in ℝ[X]∕X^n+1$ # $n$ is a power of 2
BGV	Polynomial $M\in {\mathbb{Z}}_t[X]∕X^n+1$ # $t$ is a prime, and $n$ is a power of 2

	Secret Key
TFHE	Vector $\overrightarrow{s}\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_2^k$ # $\$$ is a uniform random distribution
BFV
CKKS	Polynomial $S\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_3[X]∕X^n+1$, where we set ${\mathbb{Z}}_3=\{-1,0,1\}$
BGV

	Ciphertext
TFHE	(Vector $\overrightarrow{a}$, Number $b$) = $(\overrightarrow{a}\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_q^k$, $b\in {\mathbb{Z}}_q)$ # $q\gg t$, and $t$ divides $q$
BFV
CKKS	(Polynomial $A,B$) = $(A\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_q[X]∕X^n+1$, $B\in {\mathbb{Z}}_q[X]∕X^n+1)$ # $q\gg t$
BGV

	Noise
TFHE	Number $e\underset{}{\overset{\chi }{\leftarrow }}{\mathbb{Z}}_q$ # $\chi$ is a Gaussian random distribution
BFV
CKKS	Polynomial $E\underset{}{\overset{\chi }{\leftarrow }}{\mathbb{Z}}_q[X]∕X^n+1$
BGV

	Scaling Factor
TFHE	Used for $\mathrm{\Delta }m$, where $\mathrm{\Delta }={\displaystyle \frac{q}{t}}$ # $t$ divides $q$
BFV	Used for $\mathrm{\Delta }M$, where $\mathrm{\Delta }=\lfloor {\displaystyle \frac{q}{t}}\rfloor$ # $t$ is a prime
CKKS	Used for $\mathrm{\Delta }M$, where $\mathrm{\Delta }\cdot ||M|{|}_{\infty }\ll q_0$
	# $q_0$ is the lowest multiplicative level’s ciphertext modulus
BGV	Used for $\mathrm{\Delta }E$, where $\mathrm{\Delta }=t$ #$t$ is a prime

	Encryption
TFHE	$(\overrightarrow{a},b)$ where $\overrightarrow{a}\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_q^k$, $b=\mathrm{\Delta }m+e-a\cdot smodq$, $e\underset{}{\overset{\chi }{\leftarrow }}{\mathbb{Z}}_q$
	# After using $e$ each time, throw it away
BFV	$(A,B)$ where $A\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_q[X]∕(X^n+1)$, $B=\mathrm{\Delta }M+E-A\cdot Smodq$, $E\underset{}{\overset{\chi }{\leftarrow }}{\mathbb{Z}}_q$
CKKS	# After using $E$ each time, throw it away
BGV	$(A,B)$ where $A\underset{}{\overset{\$}{\leftarrow }}{\mathbb{Z}}_q[X]∕(X^n+1)$, $B=M+\mathrm{\Delta }E-A\cdot Smodq$, $E\underset{}{\overset{\chi }{\leftarrow }}{\mathbb{Z}}_q$
	# After using $E$ each time, throw it away

	Cryptographic Relation
TFHE	$b+a\cdot s=\mathrm{\Delta }m+e(\mathit{𝑚𝑜𝑑}q)$, where $\mathrm{\Delta }={\displaystyle \frac{q}{t}}$ # $t$ divides $q$
BFV	$B+A\cdot S=\mathrm{\Delta }M+E(\mathit{𝑚𝑜𝑑}q)$, where $\mathrm{\Delta }=\lfloor {\displaystyle \frac{q}{t}}\rfloor$ # $t$ is a prime
CKKS	$B+A\cdot S=\mathrm{\Delta }M+E(\mathit{𝑚𝑜𝑑}q)$, where $\mathrm{\Delta }\cdot ||M|{|}_{\infty }\ll q_0$
	# $q_0$ is the lowest multiplicative level’s ciphertext modulus
BGV	$B+A\cdot S=M+\mathrm{\Delta }E(\mathit{𝑚𝑜𝑑}q)$, where $\mathrm{\Delta }=t$ # $t$ is a prime

	Decryption Formula
TFHE	$m=\lceil {\displaystyle \frac{(b+a\cdot smodq)}{\mathrm{\Delta }}}\rfloor modt$
	$m=\lceil {\displaystyle \frac{(\mathrm{\Delta }m+e)}{\mathrm{\Delta }}}\rfloor modt$ # $e$ gets eliminated if $e<mfrac><mrow><mi\; mathvariant="normal">\Delta </mi>\; </mrow><mrow><mn>2</mn></mrow></mfrac>$
BFV	$M=\lceil {\displaystyle \frac{(B+A\cdot Smodq)}{\mathrm{\Delta }}}\rfloor modt$
	$M=\lceil {\displaystyle \frac{(\mathrm{\Delta }M+E)}{\mathrm{\Delta }}}\rfloor modt$ # $E$ gets eliminated if $||E|{|}_{\infty }<mfrac><mrow><mi\; mathvariant="normal">\Delta </mi>\; </mrow><mrow><mn>2</mn></mrow></mfrac>$
CKKS	$M={\lceil {\displaystyle \frac{(B+A\cdot Smodq)}{\mathrm{\Delta }}}\rfloor }_{\frac{1}{\mathrm{\Delta }}}$
	$M={\lceil {\displaystyle \frac{\mathrm{\Delta }M+E}{\mathrm{\Delta }}}\rfloor }_{\frac{1}{\mathrm{\Delta }}}$ # The final noise remains as ${\displaystyle \frac{E}{\mathrm{\Delta }}}$ (increase $\mathrm{\Delta }$ to reduce it)
BGV	$M=(B+A\cdot Smodq)modt$
	$M=(M+\mathrm{\Delta }E)modt$ # $E$ gets removed if $\mathrm{\Delta }E/mo>q$

	Ciphertext Modulus
TFHE	A single number $q$ # $q\gg t$, and $t$ divides $q$
BFV	A single number $q$ # $q\gg t$
CKKS	An $L$-multiplicative-level modulus chain $\{q_0,q_1,\cdots ,q_L\}$
	# each $q_i=\underset{j=0}{\overset{l}{\prod <!--\; FUNCTION\; APPLICATION\; -->}}{w}_j$, and each $w_j$ is a CRT modulus
	having the property: $w_0\gg \mathrm{\Delta }\cdot ||M|{|}_{\infty },w_j\approx \mathrm{\Delta }$ (for $1\le j\le L$)
BGV	An $L$-multiplicative-level modulus chain $\{q_0,q_1,\cdots ,q_L\}$
	# each $q_i=\underset{j=0}{\overset{l}{\prod <!--\; FUNCTION\; APPLICATION\; -->}}{w}_j$, and each $w_j$ is a CRT modulus
	having the property: $w_0\equiv w_1\equiv \cdots \equiv w_{L}modt$

	Ciphertext-to-Ciphertext Addition
TFHE	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1)=({\overrightarrow{a}}_1,b_1)=(a_{1,0},a_{1,1},\cdots ,a_{1,k-1},b_1)modq$
	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_2)=({\overrightarrow{a}}_2,b_2)=(a_{2,0},a_{2,1},\cdots ,a_{2,k-1},b_2)modq$
	${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }(m_1+m_2))=({\overrightarrow{a}}_1+{\overrightarrow{a}}_2,b_1+b_2)modq$
BFV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)modq$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_2)=(A_2,B_2)modq$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M_1+M_2))=(A_1+A_2,B_1+B_2)modq$
CKKS	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)mod{q}_l$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_2)=(A_2,B_2)mod{q}_l$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M_1+M_2))=(A_1+A_2,B_1+B_2)mod{q}_l$
BGV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1)=(A_1,B_1)mod{q}_l$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_2)=(A_2,B_2)mod{q}_l$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1+M_2)=(A_1+A_2,B_1+B_2)mod{q}_l$

	Ciphertext-to-Plaintext Addition
TFHE	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1)=({\overrightarrow{a}}_1,b_1)=(a_{1,0},a_{1,1},\cdots ,a_{1,k-1},b_1)modq$
	- Plaintext number $c\in {\mathbb{Z}}_t$
	${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }(m_1+c))=({\overrightarrow{a}}_1,b_1+\mathrm{\Delta }c)modq$
BFV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)modq$
	- Plaintext polynomial $C\in {\mathbb{Z}}_t[X]∕(X^n+1)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M_1+C))=(A_1,B_1+\mathrm{\Delta }C)modq$
CKKS	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)mod{q}_l$
	- Plaintext polynomial $C\in ℝ[X]∕(X^n+1)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M_1+C))=(A_1,B_1+\mathrm{\Delta }C)mod{q}_l$
BGV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1)=(A_1,B_1)mod{q}_l$
	- Plaintext polynomial $C\in {\mathbb{Z}}_t[X]∕(X^n+1)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1+C)=(A_1,B_1+C)mod{q}_l$

	Ciphertext-to-Plaintext Multiplication
TFHE	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1)=({\overrightarrow{a}}_1,b_1)=(a_{1,0},a_{1,1},\cdots ,a_{1,k-1},b_1)modq$
	- Plaintext number $c\in {\mathbb{Z}}_t$
	${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }(m_1\cdot c))=({\overrightarrow{a}}_1\cdot c,b_1\cdot c)modq$
BFV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)modq$
	- Plaintext polynomial $C\in {\mathbb{Z}}_t[X]∕(X^n+1)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }(M_1\cdot C))=(A_1\cdot C,B_1\cdot C)$
CKKS	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)mod{q}_l$
	- Plaintext polynomial $C\in ℝ∕(X^n+1)$
	1. Basic Multiplication
	1. $\mathsf{\text{𝖼𝗍}}={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^2(M_1\cdot C))=(A_1\cdot \mathrm{\Delta }C,B_1\cdot \mathrm{\Delta }C)mod{q}_l$
	2. Rescaling by ${\displaystyle \frac{1}{\mathrm{\Delta }}}$: $\lceil {\displaystyle \frac{\mathsf{\text{𝖼𝗍}}}{\mathrm{\Delta }}}\rfloor ={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1{M}_2)mod{q}_{l-1}$
BGV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1)=(A_1,B_1)mod{q}_l$
	- Plaintext polynomial $C\in {\mathbb{Z}}_t[X]∕(X^n+1)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1\cdot C)=(A_1\cdot C,B_1\cdot C)mod{q}_l$

	Ciphertext-to-Ciphertext Multiplication
TFHE	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1)=({\overrightarrow{a}}_1,b_1)=(a_{1,0},a_{1,1},\cdots ,a_{1,k-1},b_1)modq$
	- Ciphertext ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_2)=({\overrightarrow{a}}_2,b_2)=(a_{2,0},a_{2,1},\cdots ,a_{2,k-1},b_2)modq$
	1. Programmable Bootstrapping:
	1. Convert ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_2)$ into ${\mathsf{\text{𝖦𝖲𝖶}}}_{\overrightarrow{s},\sigma }^{\beta ,l}(m_2)$.
	2. Homomorphic Multiplication:
	2. Compute ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1)\cdot {\mathsf{\text{𝖦𝖲𝖶}}}_{\overrightarrow{s},\sigma }^{\beta ,l}(m_2)$
	$=\underset{i=0}{\overset{k-1}{\sum <!--\; FUNCTION\; APPLICATION\; -->}}⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(a_{1,0}),{\mathsf{\text{𝖫𝖾𝗏}}}_{\overrightarrow{s},\sigma }^{\beta ,l}(-s_i\cdot m_2)⟩+⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(b_1),{\mathsf{\text{𝖫𝖾𝗏}}}_{\overrightarrow{s},\sigma }^{\beta ,l}(m_2)⟩$
	$={\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }{m}_1{m}_2)$
BFV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)modq$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_2)=(A_2,B_2)modq$
	1. ModRaise from $q$ to $Q=q\cdot \mathrm{\Delta }$
	1. - Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)modQ$
	1. - Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_2)=(A_2,B_2)modQ$
	2. Polynomial Multiplication:
	1. $(A_1{A}_2,A_1{B}_2+A_2{B}_1,B_1{B}_2)\equiv (D_0,D_1,D_2)(\mathit{𝑚𝑜𝑑}Q)$
	3. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }=(D_1,D_0),$ ${\mathsf{\text{𝖼𝗍}}}_{\beta }=⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(D_2),{\mathsf{\text{𝖱𝖫𝖾𝗏}}}_{S,\sigma }^{\beta ,l}(S^2)⟩$
	3. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }+{\mathsf{\text{𝖼𝗍}}}_{\beta }={\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^2{M}_1{M}_2)modQ$
	4. Rescaling by ${\displaystyle \frac{1}{\mathrm{\Delta }}}$: $\lceil {\displaystyle \frac{{\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }}{\mathrm{\Delta }}}\rfloor ={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1{M}_2)modq$
CKKS	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1)=(A_1,B_1)mod{q}_l$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_2)=(A_2,B_2)mod{q}_l$
	1. Polynomial Multiplication:
	1. $(A_1{A}_2,A_1{B}_2+A_2{B}_1,B_1{B}_2)\equiv (D_0,D_1,D_2)(\mathit{𝑚𝑜𝑑}{q}_l)$
	2. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }=(D_1,D_0),$ ${\mathsf{\text{𝖼𝗍}}}_{\beta }=⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(D_2),{\mathsf{\text{𝖱𝖫𝖾𝗏}}}_{S,\sigma }^{\beta ,l}(S^2)⟩$
	3. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }+{\mathsf{\text{𝖼𝗍}}}_{\beta }={\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^2{M}_1{M}_2)mod{q}_l$
	3. Rescaling by ${\displaystyle \frac{1}{\mathrm{\Delta }}}$: $\lceil {\displaystyle \frac{{\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }}{\mathrm{\Delta }}}\rfloor ={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }{M}_1{M}_2)mod{q}_{l-1}$
BGV	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1)=(A_1,B_1)mod{q}_l$
	- Ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_2)=(A_2,B_2)mod{q}_l$
	1. Polynomial Multiplication:
	1. $(A_1{A}_2,A_1{B}_2+A_2{B}_1,B_1{B}_2)\equiv (D_0,D_1,D_2)(\mathit{𝑚𝑜𝑑}{q}_l)$
	2. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }=(D_1,D_0),$ ${\mathsf{\text{𝖼𝗍}}}_{\beta }=⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(D_2),{\mathsf{\text{𝖱𝖫𝖾𝗏}}}_{S,\sigma }^{\beta ,l}(S^2)⟩$
	3. Relinearization: ${\mathsf{\text{𝖼𝗍}}}_{\alpha }+{\mathsf{\text{𝖼𝗍}}}_{\beta }={\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1{M}_2)mod{q}_l$
	3. (Optional) Rescaling by ${\displaystyle \frac{1}{\mathrm{\Delta }}}$: ${\lceil {\displaystyle \frac{{\mathsf{\text{𝖼𝗍}}}_{\alpha +\beta }}{\mathrm{\Delta }}}\rfloor }_t={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M_1{M}_2)mod{q}_{l-1}$
	# $\lceil {\rfloor }_t$ means rounding to the nearest multiple of $t$
	# The future noise growth rate gets reduced if the ciphertext is rescaled

	Maximum Possible Multiplications (without Bootstrapping)
TFHE	Unlimited with programming bootstrapping (but not possible without it)
BFV	Unlimited
CKKS	As many times as the length of the modulus chain
BGV	As many times as the length of the modulus chain

	Key Switching
TFHE	Key-switching from $\overrightarrow{s}\to {\overrightarrow{s}}_{{}^{\prime }}$:
	${\mathsf{\text{𝖫𝖶𝖤}}}_{{\overrightarrow{s}}_{{}^{\prime }},\sigma }(\mathrm{\Delta }m)=b+a\cdot {\mathsf{\text{𝖫𝖶𝖤}}}_{{\overrightarrow{s}}_{{}^{\prime }},\sigma }(s)$
	${\mathsf{\text{𝖫𝖶𝖤}}}_{{\overrightarrow{s}}_{{}^{\prime }},\sigma }(\mathrm{\Delta }m)$ $=b+⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(\overrightarrow{a}),{\mathsf{\text{𝖫𝖾𝗏}}}_{{\overrightarrow{s}}_{{}^{\prime }},\sigma }^{\beta ,l}(\overrightarrow{s})⟩$
BFV	Key-switching from $S\to S^{\prime }$:
CKKS	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(\mathrm{\Delta }M)=B+A\cdot {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(S)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(\mathrm{\Delta }M)$ $=B+⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(A),{\mathsf{\text{𝖱𝖫𝖾𝗏}}}_{S^{\prime },\sigma }^{\beta ,l}(S)⟩$
BGV	Key-switching from $S\to S^{\prime }$:
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(M)=B+A\cdot {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(S)$
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S^{\prime },\sigma }(M)$ $=B+⟨{\mathsf{\text{𝖣𝖾𝖼𝗈𝗆𝗉}}}^{\beta ,l}(A),{\mathsf{\text{𝖱𝖫𝖾𝗏}}}_{S^{\prime },\sigma }^{\beta ,l}(S)⟩$

	Modulus Drop (ModDrop)
CKKS	- Ciphertext with the multiplicative level $l$: ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)=(A,B)mod{q}_l$
BGV	- Ciphertext with the multiplicative level $l-1$:
	- ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)=(A^{\prime },B^{\prime })=(Amod{q}_{l-1},Bmod{q}_{l-1})$

	Encoding and Decoding the Plaintext
TFHE	No need, because each plaintext is a single number
BFV	Must convert the input slots into polynomial coefficients to support batch processing:
CKKS	- Encoding input slots $\overrightarrow{v}$ into polynomial coefficients: $\overrightarrow{m}=n^{-1}\cdot \overrightarrow{v}\cdot I_n^R\cdot \tilde{W}$
BGV	- Decoding polynomial coefficients $\overrightarrow{m}$ into input slots: $\overrightarrow{v}=\overrightarrow{m}\cdot {\tilde{W}}^{\ast }$

	Input Slot Rotation
TFHE	Not applicable, because its plaintext is a single number (i.e., a single slot)
BFV	Given $\mathsf{\text{𝖼𝗍}}={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X),\sigma }(\mathrm{\Delta }M(X))=(A(X),B(X))$,
	to rotate the input slots by $h$ positions to the left:
CKKS	1. Update $\mathsf{\text{𝖼𝗍}}$ to ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X^{J(h)}),\sigma }(\mathrm{\Delta }M(X^{J(h)}))=(A(X^{J(h)})$, $B(X^{J(h)}))$
	(where $J(h)=5^{h}mod2n$)
	2. Key-switch ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X^{J(h)}),\sigma }(\mathrm{\Delta }M(X^{J(h)}))$ to ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X),\sigma }(\mathrm{\Delta }M(X^{J(h)}))$.
BGV	Given $\mathsf{\text{𝖼𝗍}}={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X),\sigma }(M(X))=(A(X),B(X))$,
	to rotate the input slots by $h$ positions to the left:
	1. Update $\mathsf{\text{𝖼𝗍}}$ to ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X^{J(h)}),\sigma }(M(X^{J(h)}))=(A(X^{J(h)})$, $B(X^{J(h)}))$
	2. Key-switch ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X^{J(h)}),\sigma }(M(X^{J(h)}))$ to ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S(X),\sigma }(M(X^{J(h)}))$.

	Bootstrapping Goal
TFHE	To reset the noise.
BFV
CKKS	To reset the ciphertext modulus from $q_0\to q_L$.
BGV

	Bootstrapping Details
TFHE	1. Modulus Switch from $q\to 2n$ to convert ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }m)\to {\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\widehat{\mathrm{\Delta }}m)=(\overrightarrow{\widehat{a}},\widehat{b})mod2n$,
	where $\widehat{\mathrm{\Delta }}={\displaystyle \frac{2n}{t}}$. # where $t$ divides $2n$
	2. Blind Rotation: Homomorphically rotate the GLWE-encrypted look-up table
	polynomial ${\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }V)$ by $\mathrm{\Delta }m+e$ positions to the left. This is done by
	by homomorphically deriving ${\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_k)$ as follows:
	${\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_0)={\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }V)\cdot X^{-\widehat{b}}$
	${\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_i)={\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_{i-1})\cdot X^{{\widehat{a}}_i{s}_{i-1}}$
	$={\mathsf{\text{𝖦𝖦𝖲𝖶}}}_{\overrightarrow{S},\sigma }^{\beta ,l}(s_{i-1})\cdot ({\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_{i-1})\cdot X^{{\widehat{a}}_{i-1}}-{\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_{i-1}))+{\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_{i-1})$
	3. Coefficient Extraction: The rotated encrypted polynomial $V_k$’s constant term value is
	$\mathrm{\Delta }m$. Extract this encrypted constant term as ${\mathsf{\text{𝖫𝖶𝖤}}}_{\overrightarrow{s},\sigma }(\mathrm{\Delta }m)$ from ${\mathsf{\text{𝖦𝖫𝖶𝖤}}}_{\overrightarrow{S},\sigma }(\mathrm{\Delta }{V}_k)$.
BFV	1. Modulus Switch from $q\to p^{𝜀}$ to convert ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)\to {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(p^{𝜀-1}M)mod{p}^{𝜀}$
	2. Homomorphic Decryption:
	$B+A\cdot {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^{\prime }S)={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^{\prime }\cdot (p^{𝜀-1}M+E+K{p}^{𝜀}))modq$, where ${\mathrm{\Delta }}^{\prime }=\lfloor {\displaystyle \frac{q}{p^{𝜀}}}\rfloor$
	3. CoeffToSlot: Multiply to the ciphertext by $n^{-1}\cdot I_n^R\cdot \tilde{W}$ to move
	the plaintext coefficients of $p^{𝜀-1}M+E+K{p}^{𝜀}$ to the input slots.
	4. EvalExp: Given the digit extraction polynomial $G_{𝜀,v}(x)$, homomorphically compute:
	$G_{𝜀,1}\circ G_{𝜀,2}\circ \cdots \circ G_{𝜀,w-1}(p^{𝜀-1}M+E+K{p}^{𝜀})$
	, and then the output $p^{𝜀-1}M+K^{\prime }{p}^{𝜀}$ gets stored in the plaintext slots.
	5. SlotToCoeff: Multiply to the ciphertext by ${\tilde{W}}^{\ast }$ to move $p^{𝜀-1}M+K^{\prime }{p}^{𝜀}$ to the
	polynomial coefficient positions and get ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^{\prime }\cdot (p^{𝜀-1}M+K^{\prime }{p}^{𝜀}))modq$.
	6. Scaling Factor Re-interpretation: View ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }({\mathrm{\Delta }}^{\prime }\cdot (p^{𝜀-1}M+K^{\prime }{p}^{𝜀}))modq$ as
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }\left(\lfloor {\displaystyle \frac{q}{p^{𝜀}}}\rfloor \cdot (p^{𝜀-1}M+K^{\prime }{p}^{𝜀})\right)\approx {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }\left(\lfloor {\displaystyle \frac{q}{p}}\rfloor \cdot (M)+K^{\prime }q\right)$
	$={\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M)modq$, an encryption of $M$ with the scaling factor $\mathrm{\Delta }=\lfloor {\displaystyle \frac{q}{p}}\rfloor$

	Bootstrapping Details
CKKS	1. ModRaise: View the ciphertext $(A,B)mod{q}_0$ as $(A,B)mod{q}_L$
	2. CoeffToSlot: Move the coefficients of $\mathrm{\Delta }M+E+K{q}_0$ to the input slots.
	3. EvalExp: Homomorphically evaluate the polynomial approximation of
	the sine function with period $q_0$ at $\mathrm{\Delta }M+E+K{q}_0$,
	which outputs an encryption of $\mathrm{\Delta }M+E$ in the plaintext slots.
	4. SlotToCoeff: Move $\mathrm{\Delta }M+E$ to the polynomial coefficient positions
	to get ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(\mathrm{\Delta }M+E)$.
BGV	1. Modulus Switch from $q_0\to \widehat{q}$ to convert
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M)=(A,B)mod{q}_0\to {\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M)=(\widehat{A},\widehat{B})mod\widehat{q}$
	, where $\widehat{q}\equiv 1mod{p}^{𝜀}$
	2. Ciphertext Coefficient Multiplication by $p^{𝜀-1}$:
	Compute $(p^{𝜀-1}\widehat{A},p^{𝜀-1}\widehat{B})=(A^{\prime },B^{\prime })mod\widehat{q}$ (where $\widehat{q}\equiv 1mod{p}^{𝜀}$)
	, which the ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(p^{𝜀-1}M)mod\widehat{q}$ with noise $p^{𝜀}E$.
	3. ModRaise: $(A^{\prime },B^{\prime })mod\widehat{q}\to (A^{\prime },B^{\prime })mod{q}_L$
	, which is the ciphertext ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(p^{𝜀-1}M+p^{𝜀}E+K\widehat{q})mod{q}_L$.
	4. CoeffToSlot: Multiply to the ciphertext by $n^{-1}\cdot I_n^R\cdot \tilde{W}$ to move
	the plaintext coefficients of $p^{𝜀-1}M+p^{𝜀}E+K\widehat{q}$ to the input slots.
	5. EvalExp: Given the digit extraction polynomial $G_{w,v}(x)$, homomorphically compute:
	$(G_{w,1}\circ G_{w,2}\circ \cdots \circ G_{w,w-1}(p^{𝜀-1}M+p^{𝜀}E+K\widehat{q}))\cdot p^{𝜀-1}$
	, and then the output $M{p}^{𝜀-1}+K^{\prime }{p}^{𝜀}$ gets stored in the plaintext slots.
	6. Homomorphic Multiplication by $|p^{-(𝜀-1)}{|}_{p^{𝜀}}$ to all slots to update the plaintext
	from $M{p}^{𝜀-1}+K^{\prime }{p}^{𝜀}(\mathit{𝑚𝑜𝑑}{p}^{𝜀})$ to $M+K^{\prime }p(\mathit{𝑚𝑜𝑑}{p}^{𝜀})$.
	7. SlotToCoeff: Multiply to the ciphertext by ${\tilde{W}}^{\ast }$ to move $M+K^{\prime }p$ to the
	polynomial coefficient positions to get ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M+K^{\prime }p)mod{q}_L$.
	8. Noise Term Re-interpretation: View ${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M+K^{\prime }p)mod{q}_L$ as
	${\mathsf{\text{𝖱𝖫𝖶𝖤}}}_{S,\sigma }(M)mod{q}_L$, an encryption of $M$ with noise $E^{\prime }=K^{\prime }$ having the
	noise scaling factor (i.e., plaintext modulus) $\mathrm{\Delta }=p$.