If you had to implement the BGN Cryptosystem, how would you do it?
Here's a paper showing how to realize the BGN cryptosystem with a prime order group.  You could implement the cryptosystem with PBC or one of the other paring libs. 

"Converting Pairing-Based Cryptosystems from Composite-Order Groups to Prime-Order Groups"
David Mandell Freeman
Eurocrypt 2010


http://theory.stanford.edu/~dfreeman/papers/subgroups.pdf
http://theory.stanford.edu/~dfreeman/talks/eurocrypt10.pdf


Have a look at slide 13 of the talk — the BGN example looks fairly simple.  The following slide suggests that prime-order BGN will be more efficient at higher security levels too. 

This is probably how I would implement it.