CKKS ModDown operation

In the “A full RNS variant of approximate homomorphic encryption” paper, we need to times p^{-1} during the ModDown operaiton.
Should this multiplication of p^{-1} be performed to the ciphertext in the coefficient representation or evalution representation (NTT) domian?

You can do it in either. In OpenFHE, we perform it in the evaluation representation. See the ApproxModDown function in dcrtpoly.cpp.

Thank you for your reply. It is very helpful. May I ask a follow up question?
Should we change from NTT representation to coefficient representation when we change the modulus of CRT? Meanwhile, the change of modulus also happened in the ModDown operation.

Also, in the line 1537 of dcrtpoly.cpp, it looks like transfer to the coefficient representation before performing any operations in the ModDown procedure.

Yes, we should do the modulus basis change in coefficient representation since we need to perform modulus reductions. We change to coefficient in line 1537, and we change back to EVALUATION in line 1564, before we multiply by P^{-1} .

Thank you for the detailed explanation. May I know the reason for transferring from NTT representation to coefficient representation to perform modulus basis change? Could you suggest any reference papers that contain the proof?

Thank you for your help.

The ApproxSwitchCRTBasis method is described in Section 2.3 in the paper you mentioned. Performing the \pmod{q_j} operation requires the polynomial to be in coefficient representation.

Thank you for your help.