1
$\begingroup$

I am looking for an encryption scheme $E$ and a commitment scheme $C$ which allow

  1. encrypting the message $m$ for the public key $y$ as $e = E_y(m)$, so that the ciphertext $e$ does not reveal any information about the recipient public key $y$
  2. committing to $y$ and $m$ as $c_y = C(y)$ and $c_m = C(m)$,
  3. to prove that the ciphertext was correctly formed with respect to committments to $y$ and $m$.

That is, given a ciphertext $e$ and commitments to the message and key, $c_m, c_y$, it should be possible to construct a zk-proof that the ciphertext was correctly formed with respect to the commitment openings:

$PK\{ (y,m): c_m = C(m) \land c_y = C(y) \land e = E_y(m)\}$.

Using elgamal encryption there are known methods for proving correct encryption (e.g. section 3.3 of Stadlers PVSS). However these methods rely on revealing the public key of the recipient, which is not acceptable in my case. Is there away around this problem?

Improve this question
$\endgroup$

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.