ElGamal and Pailler combined currently I am working on some secure accounting application. I have few requirements:

Application should store items which can be searched by name.
Every item has price and tax.
Every invoice contains arbitrary amount of different items.
Every invoice has gross and net sum of items

My idea is to use rsa or ElGamal schema for multiplication and Pailler for addition. Calculating net sum is pretty easy I can just use pailler for doing it. Problem is with gross sum. In my solution for each item I am doing multiplication: price*tax using RSA and here I am stucked.
I have only one solution in my mind: adding another trusted proxy to my system which will receive result of each multiplication, decrypt it and encrypt using Pailler scheme and than send it back to my server (which now can sum gross values of each item). That solution requires a lot of communication between server and proxy and client has to give his private keys to the proxy. Do you have any idea how can I improve it?
Thanks in advance!
There exist methods which allow to switch between a multiplicatively homomorphic encryption scheme - such as ElGamal - and an additively homomorphic encryption scheme - such as Paillier. By switch, I mean securely converting an encryption of a plaintext under one scheme into an encryption of the same plaintext under the other scheme. This is precisely what we described in this paper (see also the follow up). In these works, no proxy knows the full secret key of either scheme: the server and the proxy only have to know shares of the private keys of the scheme (hence, neither the server nor the proxy can decrypt any ciphertext alone).
Several important remarks, however:

In your question, you seem to completely ignore one of the most crucial aspects: the additive and multiplicative schemes must be compatible, in the sense that they must (essentially) operate over the same structure. By default, RSA is multiplicative over $\mathbb{Z}_n^*$ and Paillier is additive over $\mathbb{Z}_n$. These rings do not even have the same order, and this is extremely problematic - it can be easily used by an attacker to completely destroy security. Solving this issue is actually one of the main hard steps in our paper.
RSA is not secure for your application. It is only one-way; you cannot hide a money amount with a one-way scheme, since there are not so many possible values. An attacker could try to encrypt all possible amounts to learn which one was encrypted.
Is &quot;tax&quot; supposed to remain secret? I do not see why it should be a secret value in your application, since tax is typically public. If tax is public, you do not need any multiplicative scheme whatsoever: Paillier already allows to compute operations of the form $\sum_i \alpha_i \cdot m_i$ given encrypted plaintexts $m_i$ and arbitrary public coefficients $\alpha_i$.
In any case, if you need to do a single multiplication (or several &quot;single multiplications&quot; in parallel), like $\sum_i \alpha_i \cdot m_i$ (and not e.g. $\prod_{i=1}^n m_i$ for a large $n$), I would advise against using any technique for switching between encryption schemes. It will considerably complexify the construction, make it very hard to analyze and error prone, and it seems completely unnecessary. There are secure two-party protocols to securely compute, given Paillier encryptions of $x$ and $y$ respectively, a Paillier encryption of $x\cdot y$, where the two parties have shares of the secret Paillier ket (i.e. no one holds the full key). Roughly, it goes as follows: Alice picks a random mask $r$ and computes $E(x+r)$ ($E$ is Paillier encryption), the parties jointly decrypt such that Bob gets the plaintext $x+r$, and computes $E(y\cdot (x+r))$ from $x+r$ and $E(y)$. Bob sends back this ciphertext to Alice, who can herself compute $E(y\cdot r)$ (since she has $r$), and homomorphically substract the ciphertexts, getting $E(x\cdot y)$. This is a simple standard protocol to interactively multiply Paillier encrypted values.