Suppose I know an RSA public key $(n,e)$ and I create two ciphertexts: An RSA ciphertext $C_1 = m^e \mod n$ and a Paillier ciphertext $C_2 = g^m \cdot r^n \mod n^2$.

Is there a known efficient method to prove in zero knowledge that the two plaintexts are equal $\mod n$?

  • $\begingroup$ The main reason why I think a ZKP could exist in this context is that (as far as I know), these two messages are both already ${}\mod n$. What I believe makes this difficult is that they operate with different homomorphisms. $\endgroup$
    – Zarquan
    Jul 25, 2022 at 22:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.