Are there any crypto-constructions to do the following kind of "zero-knowledge proof":
- Alice encrypts a set of numbers using some cryptosystem and a secret key (e.g. Paillier crypto-system).
- Bob multiplies the ciphertexts to obtain the sum of numbers.
- Bob sends to Alice the ciphertext for the sum. Alice decrypts the sum with her secret key and then encrypts the sum with a key known by Bob.
- Bob receives the sum encrypted with his key and decrypts it successfully.
Question: how can Bob verify that Alice didn't change the sum to a different number before re-encrypting?