Public-key encryption on elliptic curves that lets encrypted amounts be added without decrypting them.