# Zero-knowledge proof with only a ciphertext

Suppose there is a plaintext p, which is encrypted with a symmetric cipher using a key k, resulting in a ciphertext c. Bob knows both c and k, but Alice knows only c. Is there any protocol by which Alice can be certain (maybe with some probability) that Bob indeed does know p, without revealing to her p itself?

Also, it be great to not have to have any third-party involved.

• Not sure if this is possible, but I found this question which is somehow related (here Alice knows $p$). Apr 9, 2019 at 9:38

• Thank you. Do you know where the following statement: every statement in NP can be proven in zero-knowledge was proved? Apr 9, 2019 at 14:05
• @GeoffroyCouteau: Is it possible to prove that $r_1 = r_2$ in the ElGamal ciphertext $(r_1G, xG + r_2H)$ without revealing either $xG$ or $r_2H$? Jan 23, 2020 at 14:23
• @GeoffroyCouteau: what if the $x$ has to be greater than $0$? If you do a range-proof (e.g. Bulletproofs) on $xG + r_2H$, then, if $r_1 \neq r_2$, the decrypted $x$ will be different and can be $<0$, right? Can you do the range-proof on $xG + r_2H + r_1G$ instead to solve this? Jan 23, 2020 at 15:16