# How to prove that a ciphertext is encrypting multiplication of two values?

Zero-knowledge proofs with soundness, completness and zero-knowledge enable a prover to convince a verifier that a witness validates successfully a predicate without giving any information about the witness and without the verifier being able to extract the witness from the commitment C. Such kind of functionalities are useful in ecash,evoting,anonymous credentials, etc. In an abstract way the sender wants to convince a set of parties that he knows how to open the commitment and also that the commitment entails a message with specific properties.

So a Zero-Knowledge proof can be seen as an extension of a commitment scheme but without giving the opportunity ever to the receiver to open the commitment and with allowing the receiver to verify a statement-predicate.

If we work in a public key setting with DLP as the hardness assumption such as ElGamal then the sender without giving the key to the untrusted verifier can provide proofs of zero-knowledge that the encrypted values does contain a value that follows some properties, using Schnnor or Pedersen protocols as a building block.

However i am not aware of any kind of proofs that the encrypted value under some stream cipher for instance:$E(m)=m \oplus k=c$ for some random key k can be used to convince the verifier that c is the encrypted value of $m=a*b$ for some $a,b \in [0,range]$. Or more generally how i can prove that i have encrypted some specific values by giving the receiver only the ciphertext. Because it might be trivial that in a protocol you can prove a zero-knowledge of a value that you hold and you can use (for obtaining access anonymously to some credentials) but in most of the times this value is sent encrypted so there must be an association between the ciphertext that truly contains what is supposed to be known in the ZK proof and the ZK proof itself

Yes, this is doable. You can verify that $m=a \times b$, given El Gamal encryptions of $m,a,b$, since El Gamal is multiplicatively homomorphic. You can also prove that the El Gamal decryption of some ciphertext is in a given range (using a combination of Schnorr proofs). Putting those two together will give your first desired primitive.
• Then you can use use a generic proof/argument system. $\;$ – user991 Dec 26 '13 at 17:03