Usefulness of Damgård–Jurik I am trying to understand what are the benefits of using Damgård–Jurik over Paillier. I understand that expansion factor decreases as s increases. But isn't it the case that this comes at the expense of security? If your goal is to reduce space overhead compared to Paillier then you might choose a smaller security parameter and a higher value for s. Or to put it otherwise for a fixed security parameter as s increases cipher-text size increases. So why not just use Paillier with a smaller security parameter?
With Damgård-Jurik, not only expansion factor is decreased: this scheme improves state of the art.

Reducing size of prime factors makes better chance of factoriation or maybe solving particular decision problem that Paillier scheme depends on.