Comment by randaouser

Probably for its homomorphic encryption properties. Used in the correct setting with the appropriate Generator ( ElGamal on Elliptic Curve Fields) it is very secure but limited in use beyond Set Intersection as the results cannot be decrypted.