1. plaintext $P$
  2. a hash function $H$, encryption $E$ with key $k$
  3. $h_p = H(P)$ and $h_{E_P} = H(E_k(P))$

Is there an encryption scheme $E$ or hash algorithm $H$ that allows proving that $h_{E_P}$ represents the same plaintext $P$ (but encrypted) without knowing $P$ itself?

In my transmission scheme, there is a trusted Broker for plaintext metadata (i.e. doesn't have the $P$ itself, but $(h_p, h_{E_P}, k)$ and I want it to "be sure" that the $K$ was really used for encrypting plaintext $P$.

  • 2
    $\begingroup$ I've edited your question into MathJax/Latex, please make sure that everything is correct. And note that the title and last paragraph doesn't match. $\endgroup$ – kelalaka Feb 17 '19 at 12:05
  • $\begingroup$ Besides Zero-knowledge proofs, that can prove any property of the ciphertext and plaintext (including the one you asked for), there exists options like "fast message franking" - eprint.iacr.org/2019/016 $\endgroup$ – Natanael Feb 17 '19 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.