Cryptosystems which support computation on encrypted data. They might be partially homomorphic (support for one operation such as + or *) or they might be fully homomorphic (any sequence of + and *).

Homomorphic cryptosystems are cryptosystems which allow computations to be carried out on ciphertext. Given two encrypted messages $c_1 = \mathcal{E}(m_1)$ and $c_2 = \mathcal{E}(m_2)$, another party can compute some function of $c_1$ and $c_2$. For example, say the other party wants to compute $m_1\cdot m_2$, the cryptosystem allows them to compute $c_1\odot c_2$ such that $\mathcal{D}(c_1\odot c_2) = m_1\cdot m_2$. Not that $\odot$ is not necessarily multiplication (and in fact often is not).

A system is said to be homomorphic with respect to addition if $m_1+m_2$ can be computed from $\mathcal{E}(m_1)$ and $\mathcal{E}(m_2)$. Homomorphic with respect to multiplication is similarly defined. A fully homomorphic cryptosystem would support any finite sequence of additions and multiplications.

Until 2009, no fully homomorphic cryptosystem existed. This changed with Craig Gentry's PhD Thesis. Much development has taken place since to make fully homomorphic encryption practical.

See also