Assume everything takes place in a prime field.

Given the following:

  • $g$ - generator
  • $s$ - secret
  • $E(K, m)$ - a public-key encryption function using public key $K$ and plaintext $m$

The creator of the secret $s$ encrypts it for the recipient who has public key $K$: $c = E(K, s)$. The creator also produces a "commitment" to the secret: $a = g^s$. $c$ and $a$ are published. As an observer (without access to $s$), I would like to verify that $a$ and $c$ match.


  • How can I check if the value which has been encrypted equals the value with which the commitment was made?
  • What public key encryption scheme should be used to enable this?
  • 1
    $\begingroup$ Thank you @kelalaka for the formatting. $\endgroup$ – oren.tysor Oct 24 at 21:11
  • $\begingroup$ You have to do calculations with encrypted data. So the encryption function must be homomorphic in some sense. It means that it is necessary to specify the $E(K,s).$ $\endgroup$ – Alexey Ustinov Oct 25 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.