Is there an algorithm that satisfies both additive homomorphism and allows for double encryption?
That is:
$$m = Dec_{sk_2}(Dec_{sk_1}(Enc_{pk_2}(Enc_{pk_1}(m))))$$
$$Enc_{pk}(m_1) + Enc_{pk}(m_2) = Enc_{pk}(m_1 + m_2)$$ $$Dec_{sk}(Enc_{pk}(m_1)) + Dec_{sk}(Enc_{pk}(m_2)) = Dec_{sk}(Enc_{pk}(m_1 + m_2)) = m_1 + m_2$$
I found the following three classic schemes on the internet, but each has its drawbacks:
Elgamal Encryption
Let plaintext $m$ be mapped to an element in the group $\mathbb{G}_p$. The private key is $sk$, and the public key is $pk = g^{sk} \pmod{p}$.
Choose a random number $r \in \mathbb{Z}_p$, and compute the ciphertext $C$:
$$c_1 = g^r \pmod{p}, \quad c_2 = m \cdot pk^r \pmod{p}$$
Elgamal encryption supports multiplicative homomorphism:
$$C_1 \cdot C_2 = m_1 \cdot pk^{r_1} \cdot m_2 \cdot pk^{r_2} = m_1 \cdot m_2 \cdot pk^{r_1 + r_2}$$
$$g^{r_1} \cdot g^{r_2} = g^{r_1 + r_2}$$
Thus:
$$m_1 m_2 = Dec_{sk}(C_1 C_2)$$
However, it does not provide perfect additive homomorphism. Although we can map $m$ to $g^m$, and encrypt $g^m$, the product $m \times n$ will correspond to $g^{(m+n)}$, which satisfies additive homomorphism. However, decrypting requires computing discrete logarithms, which is typically feasible only for small values of $m$. Since $m$ in my case can be very large and arbitrary, this scheme is not suitable.
ECC Encryption
Let plaintext $m$ be mapped to a point on the elliptic curve. The private key is $sk$, and the public key is $pk = [{sk}]G \pmod{p}$.
Choose a random number $r \in \mathbb{Z}_p$, and compute the ciphertext $C$:
$$c_1 = [r]G, \quad c_2 = m + [r]pk \pmod{p}$$
ECC encryption supports additive homomorphism:
$$C_1 + C_2 = m_1 + [r_1]pk + m_2 + [r_2]pk = m_1 + m_2 + [r_1 + r_2]pk$$
$$[r_1]G + [r_2]G = [r_1 + r_2]G$$
Thus:
$$m_1 + m_2 = Dec_{sk}(C_1 + C_2)$$
However, the addition here is point addition, not standard scalar addition.
Paillier Encryption
Paillier encryption supports additive homomorphism but does not allow for nested encryption:
$$m = Dec_{sk_2}(Dec_{sk_1}(Enc_{pk_2}(Enc_{pk_1}(m))))$$
Is there an algorithm that satisfies both conditions or an appropriate mapping that can be used in Elgamal and ECC encryption, allowing the plaintext to be mapped while simultaneously enabling scalar addition operations, without resorting to brute-force attacks like solving the DLP or ECDLP to obtain $m_1 + m_2$?
I would appreciate it very much if you could help me solve my problem.
