I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property.

I'm restricted to RSA (any padding; for hardware reasons) to implement "blindable decryption", where one party holds some encrypted data, blinds it, sends it to the decryption oracle, receives it and recovers the embedded key by unblinding.

For this a "secure-as-possible" version of RSA is required which still has the multiplicative homomorphic property.

So what is the best padding for RSA that keeps this property?

Note: An IND-CCA1 version of RSA would be perfectly fine.
My definition of best (in order of preference): Highest security level, easiest implementability, fastest run-time.

Edit: I removed the ECDH unit as the question is way more interesting this way. The ECDH unit can solve the problem using ElGamal and an ECIES like approach.

• Can you use the ECDH unit for elGamal? $\;$ – user991 Aug 12 '15 at 0:26
• @RickyDemer, I think this would be possible. But I don't know of any reliable way to convert a random 256-bit string to a 256 or 320 bit curve point. – SEJPM Aug 12 '15 at 9:36
• – user991 Aug 12 '15 at 16:58
• @R1w and SEJPM: is "still has the multiplicative homomorphic property" part of the current question? Neither the bounty notice nor the above comment mention that. And that interferes with the definition of IND-CCA1 security. – fgrieu Jul 23 '20 at 15:44
• @fgrieu yes, the homomorphic property is key to this question and CCA1 (non-adaptive CCA) allows for such schemes. – SEJPM Jul 23 '20 at 16:10