What is the intuition of canonical-embedding in homomorphic encryption based on RingLWE? In the cryptosystem based on Ring-LWE, the noise amount is measured by canonical-embedding norm.
What is the intuition behind canonical-embedding?
Consider the $m^{\text{th}}$ cyclotomic ring $R = \mathbb{Z}[\zeta] \cong \mathbb{Z}[X]/\Phi_m(X)$, where $\zeta$ is the $m$th primitive root of unity and $\Phi(X)$ is the $m$th cyclotomic polynomial. There are many possible bases for this ring, including the power basis $\{ \zeta^0, \zeta^1, \ldots, \zeta^{n-1}\}$, where $n = \phi(m)$ (Euler totient function). 

In lattice crypto, it is useful to have a notion of a short ring element. The metric used is often a function of the coefficients of the polynomial in $R$. However, different bases of this ring can result in different coefficients, including cases where 'short' elements have long coefficient vectors. 

It is necessary, then, to define geometric quantities independently of the basis representation of $R$. This the use of the canonical embedding $\sigma$, which creates a map $\sigma\colon R \mapsto \mathbb{C}^n$ that is independent of the representation of $R$. 
$$ a \in R,  \ \ \sigma(a) = \left&lt;a(\zeta_m^i)\right&gt; \ \ \text{for all } i \in (\mathbb{Z}/m\mathbb{Z})^*
$$We can now define all geometric quantities with respect to the canonical embedding. This results in a 'canonical embedding norm' which is really just any norm taken with respect to the canonical embedding. E.g. For $a \in R$, $||a||_2^{can} = ||\sigma(a)||_2$ or $||a||_\infty^{can} = ||\sigma(a)||_\infty$

There are many other useful properties of the canonical embedding, such as coordinate-wise addition and multiplication.