Is it possible to encrypt data in a way that it can be proven that the data is encrypted, without revealing the key?
- Alice chooses some plaintext, then she encrypts it with a certain scheme. She also creates a proof that she the cypher text was produced with that encryption scheme.
- When she hands that proof+cypher text to bob, he can verify the proof without contacting Alice again.
- The proof must not allow decryption of the data, in particular it must not reveal the key
- The scheme must not allow Alice to influence the generated cypher text in better than brute-force way.
As an example, most convergent encryption schemes satisfy all properties except 3:
- Alice uses the hash(which doubles as key) as proof
- Bob can decrypt the data, and verify if the hash matches the decrypted data. He doesn't need to contact anyone that knows the plaintext to do this.
- The coupling of key and plain-text hash doesn't allow Alice to influence the cypher-text directly.
My intuition tells me such a scheme is impossible, but it has been wrong often enough.
Why do I want such a scheme?
There are hosting systems(such as Tahoe Least-Authority Filesystem) where the client encrypts the data before uploading. One nice property would be if the hoster can claim that he could not have known which data he hosted, because it was encrypted.