Paper 2026/1023

Faster CoeffToSlot and SlotToCoeff for Sparsely Packed Ciphertexts with Application to CKKS Bootstrapping

Abstract

CKKS bootstrapping is a central tool for restoring the available modulus budget of approximate ciphertexts, thereby enabling homomorphic computations beyond a fixed leveled circuit. A key component is the pair of linear transformations CoeffToSlot and SlotToCoeff, which move data to the slot representation for homomorphic modular reduction and then back to the coefficient representation. In the sparse packing setting of Cheon et al. (EUROCRYPT 2018), the useful data occupy a short effective slot vector that is repeated across the full slot space. Existing methods for this setting mainly use the smaller effective dimension, whereas our approach exploits the repetition pattern itself to obtain simpler and cheaper transformations. We use the repeated slot pattern to improve the efficiency of both CoeffToSlot and SlotToCoeff. Each transform keeps multiplicative depth \(1\) and uses fewer homomorphic operators. Let \(N\) be the ring dimension, let the packed vector have length \(n/2\), and write \(r=N/n\) for the repetition factor. For each transform, when \(n\le r/2\), the cost is one plaintext-ciphertext multiplication and \(O(\log n)\) rotations. When \(n>r/2\), the cost is \(2n/r\) plaintext-ciphertext multiplications and \(O(\sqrt{2n/r}+\log r)\) rotations. We also analyze the auxiliary slots produced by the new \textsf{CoeffToSlot} layout and prove that they satisfy the same sub-Gaussian range bound as the desired coefficient slots. Consequently, under sparse-secret encapsulation, our bounds give \(K=24\) for \(p_{\mathrm{fail}}<2^{-128}\), compared with \(K=16\) for the standard layout. We implement the proposed transforms in OpenFHE using its default multithreaded configuration and evaluate them as part of the CKKS bootstrapping pipeline with sparse-secret encapsulation. For \(N=2^{16}\) and the tested effective sparse dimensions \(64\leq n/2\leq 1024\), our transforms are \(2.08\times\) to \(8.87\times\) faster than OpenFHE's depth \(1\) sparse linear transforms, yielding a \(1.22\times\) to \(6.07\times\) speedup in end-to-end bootstrapping. For \(64\leq n/2\leq 512\), our algorithm is slightly faster in end-to-end bootstrapping than OpenFHE's depth \(2\) baseline (whose time is \(1.03\times\) to \(1.25\times\) that of our algorithm) while using two fewer levels, and is comparable to the depth \(3\) baseline (whose time is \(0.86\times\) to \(1.07\times\) that of our algorithm) while using four fewer levels. The timings include the resulting EvalMod overhead associated with the larger \(K\) required by our layout. Overall, the results show that slot repetition can reduce the practical cost of CKKS bootstrapping for sparsely packed ciphertexts.