# Can McEliece cryptosystem be used as an additively homomorphic encryption scheme?

Since McElice cryptosystem is linear, if matrix G is kept constant for different plaintexts, it can be used for linearly combining the corresponding ciphertexts. In that case, what are the advantages of McEliece over Paillier encryption?

• I don't think McEliece is homomorphic because I think that if you add two ciphertexts, you get the added errors from both and as the only the errors from a single message are at the maximal capacity of the correcting code, decryption would fail. – SEJPM Oct 7 '17 at 9:20
• @SEJPM: well, obviously, you would do the same trick as you do with Lattice-based homomorphic systems; you make the initial error quite small (and enlarge the size of the system to keep security...); that way, you stay under the bounds of what the correcting code could handle... – poncho Oct 7 '17 at 20:34
• McEliece is (candidate) post-quantum. ​ Pallier will trivially fall to Shor's algorithm. $\hspace{1.28 in}$ – user991 Oct 8 '17 at 5:05

About the only thing that springs to mind is the addition operation; for Pallier, the addition operation is addition modulo $\mathbb{Z}_n$, with the homomorphic McEliece, it would be addition in some field $GF(2^n)$, for some relatively large $n$, and perhaps some application would prefer that addition.
On the other hand, there are other cryptosystems (such as Goldwasser-Micali) which are homomorphic over addition in $GF(2)$, and running $n$ parallel copies would give you addition in $GF(2^n)$. It would appear likely that the homomorphic operation in McEliece is cheaper than the homomophic in $n$-ways parallel Goldwasser-Micali; however, to me, that sounds like a minor advantage (given the other disadvantages, such as Goldwasser-Micali has no bound on the number of homomorphic operations you can do before the ciphertext becomes undecryptable)