I would like to take some additively homomorphic cryptosystem - don't care much which one for now - and encrypt a series of numbers with it. I would then like to (in public) take these numbers, add them together, decrypt the sum and convince everyone that I did it correctly.
This may seem pointless because I myself encrypted those numbers to begin with, but I'm thinking about voting applications where in reality the party who encrypted the numbers is not the same as the party decrypting the sum, and the numbers being summed/decrypted are all on a public bulletin board.
I know voting is a well studied problem in the literature, but so far none of the papers I've read have been doing it in quite the same way I'm interested in, so I see this as a good opportunity to go exploring.
So far I understand that with a regular Paillier encryption, to prove a correct decryption you can just reveal the randomness, however this does not work if you have added together ciphertexts. Exponential ElGamal would probably work for my use case, but I'm not sure if it lets me do what I need either ... plus I'm uncertain how fast a normal computer can actually brute force discrete log in a message space of say a few hundred million possibilities. I know it's perfectly possible but there's a gap between "possible" and "fast enough to be usable" and I'm unclear how to calculate this out short of just implementing it myself and trying it empirically.