# Zero-knowledge commitment verification

Assume everything takes place in a prime field.

Given the following:

• $$g$$ - generator
• $$s$$ - secret
• $$E(K, m)$$ - a public-key encryption function using public key $$K$$ and plaintext $$m$$

The creator of the secret $$s$$ encrypts it for the recipient who has public key $$K$$: $$c = E(K, s)$$. The creator also produces a "commitment" to the secret: $$a = g^s$$. $$c$$ and $$a$$ are published. As an observer (without access to $$s$$), I would like to verify that $$a$$ and $$c$$ match.

Questions:

• How can I check if the value which has been encrypted equals the value with which the commitment was made?
• What public key encryption scheme should be used to enable this?
• Thank you @kelalaka for the formatting. – oren.tysor Oct 24 at 21:11
• You have to do calculations with encrypted data. So the encryption function must be homomorphic in some sense. It means that it is necessary to specify the $E(K,s).$ – Alexey Ustinov Oct 25 at 9:12