Suppose Bob encrypts a plaintext($p$) with an FHE scheme and a key($k$), then sends the $c$ to Alice. Alice wants to know the plaintext but can't trust that Bob won't send a different string.

Can Bob prove that the $p$ he sends to Alice is a valid decryption of $c$ using zkSNARKs or another zk proof without revealing the $k$?

  • $\begingroup$ To make it more clear; FHE schemes are public key encryptions, so, Bob uses his public key or Alice? $\endgroup$
    – kelalaka
    Feb 3 at 22:24
  • 1
    $\begingroup$ I think "Proof of plaintext knowledge" is what you are looking for, though I doubt what I have linked is the state of the art. $\endgroup$
    – Mark
    Feb 4 at 7:08
  • 1
    $\begingroup$ @kelalaka although the question could be more clear, some FHE schemes are not public key schemes, e.g., TFHE, FINAL, FHEW... (But there is a black-box transformation that turns any symmetric FHE scheme into a public key one). $\endgroup$ Feb 5 at 12:34
  • $\begingroup$ @HilderVitorLimaPereira ok thanks. I need to read more and more. $\endgroup$
    – kelalaka
    Feb 5 at 12:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.