# How to prove an RSA ciphertext matches a Paillier ciphertext?

Suppose I know an RSA public key $$(n,e)$$ and I create two ciphertexts: An RSA ciphertext $$C_1 = m^e \mod n$$ and a Paillier ciphertext $$C_2 = g^m \cdot r^n \mod n^2$$.

Is there a known efficient method to prove in zero knowledge that the two plaintexts are equal $$\mod n$$?

• The main reason why I think a ZKP could exist in this context is that (as far as I know), these two messages are both already ${}\mod n$. What I believe makes this difficult is that they operate with different homomorphisms. Jul 25 at 22:50