Suppose I know an RSA public key $(n,e)$ and I create two ciphertexts: An RSA ciphertext $C_1 = m^e \mod n$ and a Paillier ciphertext $C_2 = g^m \cdot r^n \mod n^2$.

Is there a known efficient method to prove in zero knowledge that the two plaintexts are equal $\mod n$?

  • $\begingroup$ The main reason why I think a ZKP could exist in this context is that (as far as I know), these two messages are both already ${}\mod n$. What I believe makes this difficult is that they operate with different homomorphisms. $\endgroup$
    – Zarquan
    Jul 25 at 22:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.