Can you please list the pros and cons of the Paillier crypto system you have encountered or found?
Without anything to compare Paillier, the list will be small but here goes:
- Has seen a fair amount of proposed application in the published literature
- Thanks to #1 there are a number of special constructions (e.g. zero-knowledge proofs) that have been built for Paillier
- Is additively homomorphic
- Lacks small ciphertexts like what you get with elliptic curve crypto
- No standards that I'm aware of