Are there any cryptographic algorithms, which lets the user apply some modifications on the encoded data, without decoding it? I would like to encode some data with a key, and send it to a third party. They don't know the key to decode it, but I would like to make it possible for them to apply some modifications on it. Then they send i back, I can get decode it, and get the result.
For example let the encoded data is the integer 5. I encode it with a key k and it becomes xxxxxx.
The user can apply operations to xxxxxx without knowing k, like +5 and *2. After those operaions, the encoded value becomes yyyyyy.
If I decode the value with the key k, it should be 20, as if I applied +5 and *2 on the original data 5.
Are there any cryptographic algorithms like that?
Can I modify encrypted data without accessing it? if there is an example appreciate it


If access means altering the data without decryption as an attacker then the answer is yes for messages without integrity.

Take OTP, execute bit flipping attack, done.

Take CTR mode, execute bit flipping attack, done.

Take CBC, execute bit flipping attack, done.

Similarly, take any stream cipher, modify one bit,
Let $c_i = m_i \oplus x_i$ where $x_i$ is the $i$th bit form the stream cipher then
$$c_i \oplus 1 = m_i \oplus x_i \oplus 1 = \bar m_i \oplus  x_i$$ where the $\bar m_i$ is the bit complement of the bit $m_i$.


Take CFB, execute bit flipping attack, done

and so on...

These also called the ciphertext malleable.
Note that the reason for this kind of attack is that they are at most CPA secure ( well OTP can have perfect secrecy with fixed-length messages ) and that doesn't mean that the modifications are detectable. To mitigate this attack one needs at least integrity. The integrity may not be enough, since the attack in some cases reuses some part of the encryption and send it. Therefore, at least we need a Message Authentication Code (MAC), like HMAC, GMAC, CMAC, etc. With MACs, the attacker need also forge the message to execute such attacks on the encryption.
Note that the bit flipping is the minimum attack. The attacker can modify more than one bit whenever it fits their aim.

If access means you want to operate on the encrypted data that the answer is yes for a very long time;

Textbook RSA is multiplicative so that you can multiply the ciphertext. Let $(n,e)$ be the public modulus with $d$ is the private exponent. Let the ciphertext $c = m^e \bmod n$ and $c' = 2^e \bmod n$ then
$$c \cdot c' =  m^e \cdot 2^e = (2m)^e \bmod n.$$
One should keep track of the overflow that is when the modifications exceed the modulus the value will be rounded.

ElGamal can be both additive and multiplicative

Paillier encryption is additive where the multiplication of the ciphertext is the addition of the plaintext.

Goldwasser–Micali where the multiplication of the ciphertext is the x-or of the plaintext.

2DNF enables 1 multiplication and many additions.


The above was before Gentry's Seminal work; Fully Homomorphic encryption that enables operation of arbitrary operations on the encrypted data. This was envisioned by On data banks and privacy homomorphisms. by Shamir et. al, immediately after RSA.
The FHE simply having two homomorphic operations on the data so that arbitrary circuits can be computed;
$$E(a) \boxplus E(b) =E(a \oplus b)$$
$$E(a) \boxtimes E(b) =E(a \times b)$$
Note that for the plaintext and ciphertext operations different notation is used since the FHE schemes are not restricted to those. Some notable FHE libraries are;

HeLib, THFE, GSW, BGV, LTV, FHEW,....

There is a post about how these operations handled; Representing a function as FHE circuit