# Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt?

Is there an encyption scheme that combines additive homomorphism with ability to proxy re-encrypt? I've tried digging around on the Internet but haven't found anything conclusive on the topic.

-
Craig Gentry's full-homomorphic scheme is a one-time multi-use proxy-reencrypt scheme (in fact, it is this property that allows him to 'bootstrap' the scheme). It's far from efficient, however, although there is a great deal of research into making it so. –  Reid Oct 21 at 1:40
Although by their construction they are multiplicatively homomorphic (they do not state it in the paper, but works analogously to ElGamal), you can use the same trick as in "exponential ElGamal" to make them additively homomorphic, i.e., represent the messages $m$ as powers of the generator $g$ of the target group ($G_2$ in their paper), i.e., as $g^m$ for messages in $Z_p$. Then, you are, however, limited to "small" message spaces as decrypting involves computing discrete logs in $G_2$. I do not know your application, but in many scenarios that should be sufficient.