# Additive homomorphic encryption scheme without change in operator

I'm looking for an additive homomorphic encryption that the addition operator (+) in its plaintext space be the same as addition operator in its ciphertext space. (Schemes like Paillier do addition in plaintext space by multiplication in ciphertext space).

Does anybody know such a scheme?

• exactly I mean: D(E(m1)+E(m2)) = m1 + m2 Commented Aug 25, 2015 at 7:26
• I think certain lattice based encryption schemes are additively homomorphic in this sense. This includes (but is not limited to) some of the suggestions for fully homomorphic encryption schemes, although those will probably be overkill if you are just looking for additive homomorphism. A cant think of any concrete schemes right now though. Commented Aug 25, 2015 at 8:34
• Commented Aug 25, 2015 at 11:16
• On the other hand, if you want $D\hspace{.03 in}(E(m_1)\hspace{-0.04 in}+\hspace{-0.04 in}E(m_2)\hspace{-0.04 in}+\hspace{-0.04 in}E(m_3)+...\hspace{-0.05 in}+E(m_{\hspace{.02 in}n-1})\hspace{-0.04 in}+\hspace{-0.04 in}E(m_{\hspace{.02 in}n})) \: = \: m_1\hspace{-0.06 in}+\hspace{-0.04 in}m_2\hspace{-0.04 in}+\hspace{-0.04 in}m_3+...\hspace{-0.04 in}+m_{\hspace{.02 in}n-1}\hspace{-0.05 in}+\hspace{-0.04 in}m_{\hspace{.02 in}n} \hspace{1.17 in}$ for all $n$, then things will probably be more difficult. $\;\;\;\;$
– user991
Commented Aug 26, 2015 at 0:33
• From an asymptotic point of view I think the lattice schemes work for n = poly(k), for security parameter k. So, if you need more than that you are going super poly-time, and then you can just break the encryption and encrypt the result ... oh, the wonders of asymptotics. Commented Aug 26, 2015 at 7:22