# Verify hash of plaintext through ciphertext

Suppose that Alice runs a paid archival service.

1. Bob wants to download a well-known plaintext M with hash H(M) from Alice by sending her the hash.
2. Alice does not want to send M to Bob without Bob paying and Bob does not want to pay unless Alice sends him the real thing. Thus, Alice encrypts M with some temporary key K into: E(M, K) and sends that to Bob alongs with H(K).
3. Bob checks that E(M, K) is indeed M encrypted with K, knowing only {E(M, K), H(K), H(M)}.

Is step 3 possible under some crypto system?

• You probably need some form of zero knowledge proofs to do this. Jul 13, 2017 at 17:28
• I can imagine something like that using smart contracts on a blockchain... (i.e. changing steps 2 and 3 completely, but ending up with a way to ensure both delivery of the good and of the money to both receivers, without requiring a trusted third party.) This would prove useful to deal with ransomware, imho.
– Lery
Jul 14, 2017 at 14:20
• @Lery Can you share how it is done? I already read that fair exchange is impossible without a trusted third party but my case does not seem to fit the description. M is no secret, it just takes resources to store and retrieve. Jul 14, 2017 at 14:54

Because: Bob still has to trust Alice that she will send him K in case that he pays the money. So Bob could also simply trust Alice, that she has already send him the correct encrypted text E(M, K) in the first place.
• Well, this might not necessarily be the case, it all depends on the way you send the money... If the money is sent using a way which delivers it conditionally on K being correct, then Bob could send it... (But then how do you deal with dishonest Bobs? Well, the validity of K should be checked without having to trust him.) That's a nice problem to deal with. And there certainly are multiple ways around it.
• Bob can sign a contract saying: "I pay the person who puts K (or rather: something that hashes to H(K)) here and sign it". That is not my big concern for now. The contract is also much smaller compared to M so they can even use some trusted third party to settle. Jul 14, 2017 at 14:52