# CKKS bootstrapping There are multiple methods for bootstrapping: [[CKKS bootstrapping - original method]] [[CKKS slim bootstrapping -- s2c -modup -c2s-mod (reorder)]] [[CKKS integer bootstrapping]] [[CKKS Extended bootstrap]] [[CKKS bits Bootstrapping (BinBoot)]] The main idea in all methods is that after mod-up a term of $q_0I$ is added to the plaintext and so need to be removed. The original method and slim-bootstrapping is doing this by applying homomorphic modulo $q$ function on the plaintext. >Note: CKKS bootstrapping does not follow Gentry's blueprint i.e., it does not homomorphically compute the decryption function with encryption of the secret key. > ## Why a term $q_0\cdot I(X)$ is added to $m(x)$ when raising the modulo? and why its norm is small? Below is base on [^1] . Let $ct$ be a ciphertext in low modulo $q$ that encrypts the plaintext $m$ i.e., $m\approx[\langle ct,s\rangle]_q$, $\|m\| \ll q$ . The question is what the decryption of $ct$ w.r.t $s$ and $Q$ i.e., $[\langle ct,s\rangle]_Q=?$ As $m\approx[\langle ct,s\rangle]_q$, we have (1) $\langle ct,s\rangle = q\cdot I(X)+m(X)$ . we will show later that $I(X)$ has small coefficients so computing modulo $Q$ we get $(1)\ \ \ \text{Decryption}_{s, Q}(ct)=[\langle ct,s\rangle]_Q=[qI(X)+m(X)]_Q=qI(X)+m(X)$$I(X)$ has small coefficients because from (1), $qI(X) = \langle ct,s\rangle - m(X)$. the left term $\langle ct,s\rangle=ct_0-ct_1\cdot s$ has coefficients that are bounded by a small multiplication of $q$ - because $s$ is ternary (with a small hamming-weight) and the coefficients of $ct_0$ and $ct_1$ are smaller than $q$. And the coefficients of $m(X)$ are smaller than $\frac{2}{3} q$. Therefore, the coefficients of $I(X)$ are small. note: when computing $\langle ct,s\rangle$ - the computation is done in the integers and not in modulo ring. $ct_0,ct_1$ are polynomial already in modulo $q$. Therefore, the term $qI(X)$ is the result of $ct_1\cdot s$ that is computed in the integers ring.