Modulus Switching

Modulus switching transforms a ciphertext defined modulo a large integer Q into an equivalent ciphertext modulo a smaller integer q. The operation works by multiplying the ciphertext by the ratio q/Q and applying a rounding step. Crucially, the absolute magnitude of the embedded noise is scaled down by approximately the same factor, while the noise-to-modulus ratio remains roughly constant. This provides a controlled method for resetting the noise budget after multiplicative operations, enabling deeper circuits without bootstrapping.

• Input: Ciphertext modulo Q with noise magnitude E
• Output: Ciphertext modulo q with noise magnitude ≈ E · (q/Q)
• Key property: No secret key required—this is a public operation

In leveled fully homomorphic encryption schemes like BGV and BFV, modulus switching is the primary noise management tool that enables multi-level arithmetic circuits. Each multiplicative level consumes part of the noise budget; modulus switching is applied after multiplication to reduce noise back to a manageable level. The modulus chain is a precomputed sequence of decreasing moduli Q₀ > Q₁ > ... > Qₗ, where each switch moves down one rung. This eliminates the need for expensive bootstrapping until the entire chain is exhausted.

• BGV: Uses modulus switching after every multiplication
• BFV: Can defer switching via scale-invariant techniques
• Depth limit: Determined by the length of the modulus chain

While modulus switching and rescaling in the CKKS scheme are mathematically similar, they serve different conceptual purposes. Modulus switching in exact-arithmetic schemes (BGV/BFV) is purely a noise management operation. In CKKS, rescaling additionally divides the encrypted message by a scale factor Δ to maintain a stable fixed-point representation after multiplication. This dual role means CKKS rescaling simultaneously manages noise and controls the encoding scale.

• BGV/BFV modulus switching: Noise reduction only
• CKKS rescaling: Noise reduction + scale stabilization
• Both: Reduce modulus size and consume one level of the chain

The finite capacity for error accumulation within a ciphertext. Each homomorphic operation, particularly multiplication, consumes this budget. When the noise magnitude exceeds a critical threshold relative to the ciphertext modulus, decryption fails. Modulus switching is the primary technique for proactively managing this budget by scaling down both the ciphertext and its embedded noise.

In the CKKS scheme, rescaling is the specific instantiation of modulus switching. After a multiplication, the ciphertext scale factor grows quadratically. Rescaling divides the ciphertext by a fixed scale factor and truncates the modulus chain by one level, maintaining a stable scale and reducing noise. It is functionally identical to modulus switching but tightly coupled with CKKS's fixed-point arithmetic.

A variant of FHE that supports computation up to a predetermined multiplicative depth without bootstrapping. The circuit depth must be known before encryption. Each multiplication consumes one level from the modulus chain. Modulus switching is the mechanism that drops a level after each multiplication, making it the fundamental operation that defines leveled HE execution.

A cryptographic technique that refreshes a ciphertext by homomorphically evaluating the decryption circuit, resetting the noise budget to enable unlimited computation depth. While modulus switching manages noise within a fixed circuit depth, bootstrapping is required when the modulus chain is exhausted. The two techniques are complementary: modulus switching for leveled efficiency, bootstrapping for unbounded computation.

The lattice-based hardness assumption operating over polynomial rings that underpins the security of modern HE schemes. Ciphertexts in RLWE-based schemes contain a noise term sampled from an error distribution. Modulus switching exploits the mathematical structure of RLWE to scale down the ciphertext modulus while preserving the ratio of noise to modulus, effectively reducing absolute noise magnitude without secret key knowledge.

A cryptographic operation that transforms a ciphertext encrypted under one secret key into a ciphertext encrypting the same message under a different key. Modulus switching is a key-free operation—it requires no evaluation keys—while key switching requires public switching keys. Both are used together in HE multiplication: modulus switching manages noise, while relinearization (a form of key switching) reduces ciphertext size.