Ok, I'm probably missing something. How is public-key homomorphic encryption possible? Suppose I know the pub-key, and have some cipher text X. Can't I simply

Ok, I'm probably missing something. How is public-key homomorphic encryption possible? Suppose I know the pub-key, and have some cipher text X. Can't I simply encrypt 0 and try, for all plausible values V, whether encrypt(V) - X = encrypt(0). Or is the encryption function not reversible, i.e. there are multiple 0s? If not, it seems like you'd need quite a bit of true entropy in the plausible values. I don't see how you add something like a Nonce to artificially add entropy. Heck, if you have nice integer under/over flow on division, that would give a crude implementation of comparison, bringing the search down by a logarithm. It seems like the only reasonable situation is one where indeed multiple different values decrypt to 0.