The set of polynomials of degree $k$ with coefficients in a field $\mathbb{F}$ is a vector space $V$ isomorphic to $\mathbb{F}^{k+1}$, regardless of the field $\mathbb{F}$.
This vector space has many possible choices of basis.
A very popular one (for polynomials) is the "coefficient basis".
This has relatively poor computational properties though, namely polynomial multiplication in this basis is $O(n^2)$ naively, and maybe $O(n^{\approx 1.5})$ using things like Karatsuba.
For any set $\mathsf{P} = \{x_1,\dots, x_{k+1}\}$ of distinct points, one may instead represent a polynomial $p(x)$ via their vector of evaluations $(p(x_1),\dots, p(x_{k+1}))\in\mathbb{F}^{k+1}$ on these points.
I'll call this vector space $V^\mathsf{P}$.
This basis has better properties, namely that addition and multiplication of polynomials corresponds to element-wise addition and multiplication.
This implies
- faster computation (namely $O(n)$ addition and multiplication for polynomials represented in this basis), and
- easier bounds --- for $f, g\in V^\mathsf{P}$, one has that $\lVert f\ast g\rVert_{2}^{\mathsf{P}} \leq \lVert f\rVert_{\infty}^{\mathsf{P}} \lVert g\rVert_{2}^{\mathsf{P}}$, where by $\lVert f\rVert_{p}^{\mathsf{P}}$ I mean the $\ell_p$ norm on the vector space $V^\mathsf{P}$, rather than the $\ell_p$ norm of the coefficient vector (which I will write as $\lVert \cdot\rVert_p$).
The NTT and canonical embedding corresponding to performing the above for certain distinguished sets of $\mathsf{P}$, though for different reasons.
In the NTT, one chooses $\mathsf{P}$ to be powers of a suitable root of unity within $\mathbb{F}$, a finite field. This is so that basis conversion $\mathsf{NTT}: V\to V^{\mathsf{P}}$ (and the reverse direction) are $O(n\log n)$ time. There is no other real requirements, in particular the NTT will not satisfy the "geometric" property I mention next
In the canonical embedding, one again chooses $\mathsf{P}$ to be powers of a suitable root of unity within $\mathbb{F} = \mathbb{C}$. This is so that $\lVert f\rVert_2 = \sqrt{n}\lVert f\rVert_2^{\mathsf{P}}$ is isometric to the $\ell_2$ norm of the coefficient vector, e.g. converting to the canonical embedding (when bounding quantities) is "exact", versus inducing some loss.
As for the implementations/theoretical analysis using canonical embedding/NTT, this is for the reason above.
Theoretical analysis generally identifies some error polynomial $e$ (which may be sums and products of other polynomials), and attempts to bound it with high probability.
This bound is done with respect to (typically) the $\ell_\infty$ norm over $\mathbb{Z}$, not a finite field (where the various "norms" one could try to define do not make much sense).
So, one views $\mathbb{Z}\subseteq \mathbb{C}$, and uses the canonical embedding to clean up analysis.
By contrast, implementations only want to compute things fast, so use the $\mathsf{NTT}$ for this purpose.
There are some times the canonical embedding appears within implementations (sort of) though
In CKKS, one models the input domain as $\mathbb{R}^n$, and then approximates these values with certain discrete values. This is done by identifying $\mathbb{R}^n\cong \mathbb{C}^{n/2}$, applying the (inverse) canonical embedding, and then scaling and rounding values iirc (it is called "encode" and "decode" in the CKKS paper).
One can use things close to the canonical embedding in other implementations. In particular, one can use the FFT for fast multiplication, similarly to the $\mathsf{NTT}$. This requires encoding ciphertexts with floating-point numbers, which brings all kinds of annoyances. One can avoid many of these by only encoding ciphertexts into the significand, e.g. for 64-bit floating point numbers using them as a source of 53-bit integer arithmetic. This is mildly wasteful, but if one has a very high-quality FFT implementation (perhaps a hardware-aided FFT multiplier) it is something to consider. The FHEW FHE scheme initially used an FFT multiplier along these lines, though I believe this is less popular lately, as NTT (software) implementations have become higher quality.
