IND-CPA secure RSA padding with a partial homomorphic property
Here is a padding scheme for RSA that I crafted for the question. It allows encryption of strictly positive integers up to some moderate bound $b$, and such that the (ordinary) product of the plaintexts can be found from the product of the ciphertexts modulo the public modulus $N$ (with knowledge of the private key, by the method's normal decryption and unpadding method).

Plaintext $x$ with $1\le x\le b&lt;N^{1/8}$ is randomly padded as $y=x\,r$, where random padding multiplier $r$ is a randomly seeded prime with $N^{1/8}&lt;r&lt;N^{3/8}$. Raw RSA encryption is then applied to $y$.

After raw RSA decryption, unpadding pulls the factors of $y$ at most $b$, and outputs their product $x$. It is possible to recognize a ciphertext obtained by using the homomorphic property from one that is not, by testing if $y/x$ is composite or not.

This has no discernible practical interest, but seems plausibly IND-CPA secure, and actually workable: padding can be made more efficient than RSA key generation; Pollard's Rho is enough for decryption for small $b$, and ECM will make $b=2^{128}$ feasible.



Variants are possible allowing decryption of the product of up to $h&gt;2$ terms, by adjusting $b$ and the bounds for $r$. We want that $r_\text{max}&lt;N^{1/h}/b$ and $r_\text{min}&gt;b$. If we go that route, we also need to check that the public exponent $e$ is high enough that it remains overwhelmingly likely that $e\log_2r\gg\log_2N$, in order to prevent an $e^\text{th}$ root attack; and that there remains ample entropy in the choice of $r$ (well over twice as many bits as the security level) in order to avoid some meet-in-the-middle attacks.

We also have the option to widen the choice of the padding multiplier $r$, allowing any $r$ such that all its prime factors are above the plaintext bound $b$. That allows selection of $r$ in ways speeding-up (at least on average) the factorization job for un-padding. This is especially desirable for ciphertext obtained by the homorphic property, where it becomes compute-intensive to ensure that all unknown factors of $y$ are above $b$. We can choose $r=\prod s_i$ as the product of random primes $s_i&gt;b$ :


with $s_i$ bounded by some moderate $s_\text{max}$, which will make Pollard's Rho efficient;
or with $s_i=1+\prod t_j$ for random primes $t_j$ bounded by some even more moderate $t_\text{max}$, which will make Pollard's $p-1$ efficient.