---
title: CKKS Homomorphic Encryption Scheme
url: https://www.emergentmind.com/topics/ckks-homomorphic-encryption-scheme
type: topic
---

# CKKS Homomorphic Encryption Scheme

The Cheon–Kim–Kim–Song (CKKS) homomorphic encryption scheme provides native approximate arithmetic over vectors of real or complex numbers via a lattice-based cryptosystem rooted in the Ring Learning with Errors (RLWE) assumption. CKKS is distinguished by its support for vectorized SIMD computation, precise control over arithmetic error via rescaling, and by its suitability for privacy-preserving protocols in domains demanding high-performance floating-point or complex-number manipulation. This scheme’s design enables the secure offloading of numerical workloads—including optimization, linear algebra, and machine learning—to untrusted servers with end-to-end confidentiality and tunable accuracy guarantees. CKKS’s pivotal innovation is a scale-invariant encoding that balances noise growth and functional depth, making it fundamentally different from integer-only schemes such as BFV and BGV.

## 1. Algebraic Foundations and Encoding

CKKS operates over cyclotomic polynomial rings of the form $R_q=\mathbb{Z}_q[x]/(x^n+1)$, with $n$ a power of two and $q$ an integer modulus, often implemented as a product of RNS primes. Plaintext data—typically a vector $x\in\mathbb{C}^{n/2}$—is embedded into $R_q$ via the canonical embedding $\sigma:R_q\rightarrow\mathbb{C}^n$, pairing each coefficient with a complex conjugate to ensure real representability.

The encoding procedure consists of three steps:
1. Map the desired vector $x$ to a length $n$ vector via $\sigma^{-1}$ (inverse FFT/interpolation).
2. Multiply by a large scaling factor $\Delta=2^p$ to shift the fractional data into the integer domain.
3. Round each coefficient to the nearest integer, yielding $m(x)=\lfloor \Delta\,\mu \rceil\in R_q$.

The choice of scaling factor $\Delta$ determines the maximal achievable precision under noise propagation and sets the normalization for all subsequent homomorphic operations [2309.01559].

## 2. Key Generation and Cryptographic Primitives

Key material includes a secret key $sk$—a small ternary or Gaussian polynomial $s\in R_q$—and a public key $pk=(pk_0, pk_1)$ with $pk_0=-a\cdot s + e$ and $pk_1=a$ for uniform $a\in R_q$ and error $e$ sampled from a discrete Gaussian distribution. To enable multiplicative depths beyond one, the scheme requires evaluation keys for relinearization and Galois automorphisms (“rotation keys”) for slot-wise vector rotations.

The cryptosystem’s security relies on the hardness of RLWE in $R_q$, with the concrete parameter choices (ring degree $n$, modulus chain $q_0>\cdots>q_L$, error width) designed to ensure IND-CPA security against quantum adversaries and to control both ciphertext expansion and the noise budget [2205.03511].

## 3. Encryption, Decryption, and Message Recovery

Encryption of message polynomial $m\in R_q$ is performed by:
- Sampling a fresh error $e$ and random $a\in R_q$.
- Outputting ciphertext $(c_0, c_1) = (a\cdot pk_0 + e + m,\, a\cdot pk_1)$.

Decryption involves computing $\hat{m}=c_0 + c_1\cdot s \pmod{q}$, then dividing by $\Delta$ and applying the canonical embedding $\sigma$ to recover the plaintext vector. Correctness requires that the total noise—composed of encoding rounding error and RLWE noise—remains below $q/2$ at every modulus level [2309.01559], [2508.02943].

## 4. Homomorphic Operations: Addition, Multiplication, Rotation, and Scale Management

CKKS implements the following core SIMD operations on packed vectors:

- **Addition:** For ciphertexts $(c_0, c_1)$, $(d_0, d_1)$ of the same scale, summation is performed componentwise. Resulting noise grows additively, and the scale remains unchanged.

- **Multiplication:** Ciphertext multiplication yields a three-component result, increasing the plaintext scale from $\Delta$ to $\Delta^2$ and the noise by terms proportional to both operands' noise and the scaling factor. Relinearization (via evaluation keys) collapses the result back to CKKS’s two-component form, and **rescaling** divides ciphertext coefficients by the current modulus $q_i$, dropping to $q_{i-1}$, restoring the scale to $\Delta$. This prevents exponential growth in magnitude and ensures that the relative error remains bounded across multiplicative layers [2503.16080], [2508.02943].

- **Rotation:** Precomputed Galois keys enable cyclic slot-wise rotations without changing scale, crucial for implementing vectorized inner products and reductions in SIMD-packed data.

Rescaling is triggered precisely after each multiplication, consuming one modulus in the chain and bounding noise-to-scale ratio. Practical parameter selection ensures that the modulus chain length matches the algorithm’s required multiplicative depth, and that $\Delta$ is large enough to preserve required precision even after repeated noise accumulation [2309.01559].

## 5. Parameter Selection, Noise Growth, and Performance

Critical parameters and their impact:
- **Ring dimension $n$:** Controls both post-quantum security and packing capacity. Higher $n$ increases the number of SIMD slots and the noise tolerance but results in higher computational cost per operation [2205.03511].
- **Scaling factor $\Delta$:** Typically set in the $2^{30}$ to $2^{60}$ range in practical deployments; larger values allow more decimal precision but incur faster noise level increases per multiplication.
- **Modulus chain $q_0 > \cdots > q_L$:** Each multiplication/rescale step reduces the chain’s length by one level; multiplicative circuit depth $L$ is bounded by chain length.
- **Noise budget:** Each addition increases noise additively; multiplication increases noise approximately as $\nu_1B_2 + \nu_2B_1 + B_1B_2$ (where $B$ are operand noise magnitudes) [2508.02943].

Benchmarking reveals that the number of allowed sequential multiplications is tightly constrained by noise saturation (the “multiplicative depth”). For instance, in a CPU-based MS-SEAL implementation, homomorphic multiplicative depth was capped at 18, permitting 9 gradient steps in homomorphically encrypted gradient descent for QP [2309.01559]. Empirical studies consistently report $6$–$8$ decimal digits of accuracy after several (6–9) iterations; further operations degrade precision below acceptable levels [2309.01559], [2309.07284].

Performance overhead is considerable: each multiplication takes milliseconds to tens of milliseconds in CPU settings, with additional costs for key switching and rotation. GPU-optimized libraries achieve significant speedups—up to $70\times$—especially for bootstrapping and slot-wise SIMD primitives [2507.04775].

## 6. Applications and Practical Significance

CKKS is uniquely positioned among lattice FHE schemes for privacy-preserving real-valued iterative algorithms. It supports native real and complex arithmetic, facilitating:
- Encrypted gradient descent for quadratic and convex optimization, where arbitrary real-valued step sizes are critical for convergence and analysis. Standard integer or fixed-point schemes (BFV, BGV) are fundamentally inadequate for practical step sizes due to rapid noise explosion or insufficient granularity [2309.01559].
- Large-scale linear algebra, with vectorized matrix–vector and matrix–matrix multiplication mapped to a small number of cleartext modular matrix products via BLAS integration, improving throughput by factors of $4$–$12$ compared to cleartext [2503.16080].
- Encrypted value iteration and TD learning in reinforcement learning, where approximate linear updates (encoded as polynomials) remain feasible provided the noise budget is carefully managed; analytic noise-propagation bounds are available [2103.11065].
- General machine learning protocols—including KNN, linear regression, and inference in shallow neural-net architectures—where performance is empirically close to plaintext baselines with careful parameter tuning and polynomial approximations for non-linearities [2604.23245], [2309.07284].

## 7. Limitations, Trade-offs, and Recent Extensions

CKKS’s main challenge is aggressive noise growth, especially from multiplicative layers and rescaling operations:
- Multiplicative depth remains the bottleneck for deeply iterative or high-degree circuits. Bootstrapping can refresh the noise budget but incurs its own computational cost. Recent binary-ring CKKS variants propose lightweight bootstrapping (“Refresh”) replacing modulus switching and employing BCH error correction, yielding unbounded depth at the cost of higher ciphertext size and modest overhead [2508.02943].
- The absence of native non-polynomial operations (e.g., division, comparison, modular reduction) restricts supported workloads. Polynomial approximations (e.g., Chebyshev for mod) are deployed for extended functionality but increase circuit depth [2512.19951].
- Encrypted control pipelines for multi-agent and cyber-physical systems are feasible with explicit error budgeting (e.g., periodic bootstrapping as an impulsive disturbance), making it possible to derive precise privacy–accuracy trade-offs in closed-loop scenarios [2606.07375].
- Parameter selection and scheme tuning require balancing security, throughput, and numerical precision, and depend on the structure of the target workload.

Recent efforts focus on efficient packing, better hardware utilization (notably GPU and multi-GPU backends), multi-input multiplication, and more expressive data representations through optimized tensor packing and einsum abstractions [2601.15401], [2507.07972], [2503.16080].

---

CKKS thus constitutes the state-of-the-art for privacy-preserving, approximate arithmetic in polynomially encoded SIMD vectors, enabling secure offload of high-value numerical workloads that would otherwise be intractable with integer-only or exact-arithmetic homomorphic schemes. Its efficient error management, tunable parameter space, and compatibility with both CPU and GPU-accelerated backends establish it as the principal enabling technology for modern encrypted scientific and ML computation [2309.01559], [2503.16080], [2103.11065], [2508.02943], [2606.07375].

Source: https://www.emergentmind.com/topics/ckks-homomorphic-encryption-scheme