Auditable encrypted ledger

Question

Consider a cloud-based accounting system that needs access to aggregate information such as an account's balance but doesn't need access to individual transaction amounts in a ledger.

Does there exist a homomorphic encryption scheme that allows a public observer (such as a cloud computing provider) to compute the plaintext sum of a set of encrypted unsigned integers without being able to decode any individual transaction value (n=1 notwithstanding)?

As another example, regulations exist to ensure capital reserves. An institution could use such a scheme to furnish proof of compliance without disclosing individual transactions.

Answer 1

For all non-negative integers $n_0$,$n_1$,$n_2$ and random strings $r_0,r_1,r_2$

$n_0 \:\: = \:\: (n_0+n_1+n_2)-(n_1+n_2)$
$=$
$\operatorname{plaintextsum}(\operatorname{encrypt}(n_0,r_0),\operatorname{encrypt}(n_1,r_1),\operatorname{encrypt}(n_2,r_2))$
$- \: \operatorname{plaintextsum}(\operatorname{encrypt}(n_1,r_1),\operatorname{encrypt}(n_2,r_2))$

.


Therefore any such scheme would be completely insecure
if more than 2 non-negative integers are encrypted with it.

Answer 2

The idea could work. The cyphertext would need to come with a non-interactive zero-knowledge proof that the plaintext lies in a certain interval ([0,100] for example) See link below for more details.

It is important to note that the answer at the end needs to be decrypted so it requires use of a decryption oracle at least once. Threshold encryption might be useful here.

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.103.4029&rep=rep1&type=pdf