I need some algorithm that satisfies:

  • H - hash function
  • Enc - encryption function (using public key)
  • M - secret data
  • $Enc(H(M)) = H(Enc(M))$

Let this system exist: the First person has a secret data $M$, he publishes hash H(M) so everyone knows it. He encrypts data with public key of the second person and publishes it, so second can get and decrypt it. But the third person needs to check if the published hash is a hash of data that was encrypted and sent without knowing the data.

  • $\begingroup$ why not hash the encrypted data. since only the second person can see the data. $\endgroup$
    – kelalaka
    Oct 6, 2018 at 16:45
  • $\begingroup$ Becouse everyone need to know that data is same as data, that was hashed without encryption. If first person will be able to publish the hash of the encrypted data, then nobody can proove that first did not change encrypted data and hash. $\endgroup$
    – Nonam
    Oct 6, 2018 at 16:53
  • $\begingroup$ so, there are more than 3 people? Does the first person is trustable? $\endgroup$
    – kelalaka
    Oct 6, 2018 at 16:56
  • $\begingroup$ At least 3 people, but can be more. Not so much, only trustable part of information from first person is hash. Third person or any number of people that same as third are trustable. $\endgroup$
    – Nonam
    Oct 6, 2018 at 17:02
  • 4
    $\begingroup$ One issue is that homeomorphic encryption algorithms are nondeterministic; that is, they include a random value which affects the actual ciphertext (but not the meaning of the ciphertext). Because of this, your equality comparison doesn't look like it'd work. Instead, lets take a step back; what is the problem you're trying to solve? $\endgroup$
    – poncho
    Oct 6, 2018 at 18:34

1 Answer 1


Note: I'm not a cryptographer, please take what I write below with a grain of salt. Most probably this protocol, without further fixes (or even fundamentally), is flawed.

I'm reformulating your question as follows, dropping the hash requirement, and replacing it with an interactive proof.

  • Alice has a message $m$ and wants send this message $m$ to Bob.

  • Charlie is monitoring the public communication between Alice and Bob; and wants Alice to publicly release a blinded version of $m$; so that he can verify Alice indeed is sending the encrypted version of $m$ to Bob.

The protocol has 2 parts in it; but first let's define the parameters.

  • $m$ is the message from Alice to Bob
  • $(e,N)$ is Bob's RSA public key, $(d,N)$ is Bob's private key.

Encryption and Blinding

  1. Charlie creates a random number $1 < r < N$ and announces it publicly.
  2. Alice computes the following values:

    • $x = m^e \bmod N$ (RSA encrytion)
    • $x_{blinded} = (m * r)^{e} \bmod N$ (Note that $(m * r)^{e} = m^e * r^e$)
  3. Charlie then, verifies $x_{blinded} = x * r^e$ (this way Charlie ensures that, $x$ indeed contains the encrypted message)


  • Bob decrypts $x$, calculating $m = x^d \bmod N$ (RSA decryption)
  • 1
    $\begingroup$ I wil update this, using the same idea, with a simpler scheme. $\endgroup$
    – zetaprime
    Oct 9, 2018 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.