Homomorphic Addition and Subtraction using ElGamal

Prof Bill Buchanan OBE
2 min readDec 13, 2021


The next few years are likely to see an increase in the usage of homomorphic encryption, and where we can perform arithmetic operations on encrypted data. For example, we can perform searches on data, without actually revealing the contents of the data elements. Some methods proposed are partially homomorphic, and which can implement one or more arithmetic methods, but not all of them. In this case, we will look at the ElGamal method, and implement a simple program to add and subtract values in a homomorphic way.

ElGamal method

With the ElGamal encryption method, we can implement homomorphic addition and subtraction. Initially, we have a private key of x and a public key of:


and where G is the base point on the curve. A cipher is made up of:




The value of M is then:


and where v is the integer value that we want to operate on. To decrypt we basically take the private key (x) and compute:

S = x. C_1

and then recover the message with:

M = C_2-S


If we add two ciphertext values (created from two random numbers of r_1 and r_2), we get:

C_1=r_1 G+r_2 G=(r_1+r_2)G


C_2=r_1 Y+r_2 Y+M_1+M_2=(r_1+r_2)Y+(M_1+M_2)

When we decrypt, we create:

S=x C_1=x(r_1+r_2)G=(r_1+r_2)xG=(r_1+r_2)Y



We then get a point on the elliptic curve that relates to our result (res.G), and need to find res. We must search for the point to recover the result. The problem we have is:


and we need to recover res to find the result. This can be done by brute force if the result is relatively small, but we can also solve for:




Prof Bill Buchanan OBE

Professor of Cryptography. Serial innovator. Believer in fairness, justice & freedom. Based in Edinburgh. Old World Breaker. New World Creator. Building trust.