Alice and Bob are going to follow the protocol below. Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?:
- Alice encrypts a set of numbers using some cryptosystem and a secret key (e.g. Paillier crypto-system).
- Bob multiplies the ciphertexts to obtain an encryption of the sum of numbers.
- Bob sends to Alice the ciphertext for the sum. Alice decrypts the sum with her secret key and then encrypts the sum with a key known by Bob.
- Bob receives the sum encrypted with his key and decrypts it successfully.
Question: how can Bob verify that Alice didn't change the sum to a different number before re-encrypting? Is some sort of zero-knowledge proof helpful?