Homomorphic Encryption: how does the equality test on ciphertexts work? Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$.


Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and obtains the ciphertext $C = H(M)$
Alice sends $C$ to Bob
Bob computes $F$ over $C$ and obtains $C' = F(C)$
Bob sends $C'$ to Alice
Alice wants to check whether $C'$ is equal to some number $n$.


Let's suppose the decryption operation is costly, much more costly than the encryption. Can Alice check the equality by comparing the encryption of $n (H(n))$ and $C'$? Is that possible? With which homomorphic crypto-system(s)?
No, what you want to do is not possible, because encryption is randomized: if you were to encrypt the same message many times, you'd get many different ciphertexts.  Therefore, Alice can't just compare two ciphertexts to see if they are the same; the two ciphertexts will be different even if they decrypt to the same thing.