Short version:
Given a hash of a plaintext, a public key, and a ciphertext (but not knowing the original plaintext), is there any way to verify that the ciphertext is the plaintext after being encrypted with the public key?
Long version:
I'd like to develop a broker that can pass to a recipient a message of which it knows the ciphertext and the plaintext's hash (but not the plaintext itself), but will only do so if it can be confident that the ciphertext is indeed the original message that was encrypted using the recipient's public key (which it knows).
This is somewhat similar to proxy re-encryption, except that the proxy is only verifying the public key of the re-encryption, not actually doing the re-encryption. Perhaps there's a way to do this through holomorphic encryption?
As far as I'm aware, there is currently no way to do this. But, advancements in zero-knowledge proofs and other cryptographic tricks are happening so quickly that I wanted to check and see if this could be done before giving up on it.
You may ask "why doesn't the recipient just try to decrypt it and verify it against the cipher text hash?" That is not feasible in this use case, because other actions are tied to the broker forwarding messages and they shouldn't happen unless it's actually a valid message. i.e. there are good reasons that the broker cannot forward an invalid message.