Let's say Alice has file $F$ and she generates key $K$. She widely publishes the $hash(F)$ for identification. She wants to sell the file to Bob. She encrypts the file with $K$ and sends both $E_f = E(F, K)$ and $hash(K)$ to Bob. However, Bob wants to verify that this encrypted file really is the one he has asked to buy.
How can Bob verify that $hash(Dec(E_f, K)) = hash(f)$ knowing only $hash(K)$ and $E_f$? He shouldn't be able to decrypt the file, but should be able to prove that the encrypted file Alice sent, when decrypted, matches the hash, $hash(f)$.
It seems like I might need to use some sort of ZK-proof, but that may not work because the proof would be prohibitively large.
This question may be similar to: Proof that a hash matches an encrypted file, however, knowing only the hash of the key seems to present a different problem.
This could also be looked at as a Proof-of-Knowledge of a key $K$ such that $hash(K)$ matches the one Alice revealed to Bob and $Dec(E_f, K) = hash(f)$.