Reduce key switching noise in the SPARSE ENCAPSULATION mode of CKKS (functional) bootstrapping

[yspolyakov]

Instead of extending to a single-modulus $p$, extend to auxiliary limbs, e.g., $p_1 p_2$, so that the key switching noise would become comparable to modulus switching noise.

[yspolyakov]

Using two 33-bit moduli for auxiliary limbs should be sufficient to make the key switching noise close to the modulus switching noise, even for 60-bit $q$. 6 extra bits would compensate the difference between a Gaussian bound and a ternary distribution bound. It also appears that 126-bit moduli with the Hamming weight of 32 should still achieve 128-bit security, but this needs to be verified.