Suppose user A encrypts some data using his public key and stores the data publicly. Later user A would like to transfer that same data to user B publicly by encrypting it using user B's public key.

What is the best way to verify that the same data was transferred to user B without knowing the data, user A, and user B's private keys?

  • $\begingroup$ Is it homework? $\endgroup$
    – Ievgeni
    Commented Jun 29, 2021 at 9:21
  • $\begingroup$ no, trying to figure out if this is possible at all and what I should read more about. Would like to create something of this sort on Ethereum so secret data can be transferred securely between people publicly. $\endgroup$
    – Newbie
    Commented Jun 29, 2021 at 9:23
  • $\begingroup$ Question : Is it a deterministic encryption scheme? $\endgroup$
    – Ievgeni
    Commented Jun 29, 2021 at 9:24
  • $\begingroup$ I don't know if this is possible at this point so it's too early to set any boundaries. Would be preferable if it's deterministic though. $\endgroup$
    – Newbie
    Commented Jun 29, 2021 at 9:27
  • $\begingroup$ Other question : Is $A$ authorized to add new data (like ZK-proofs) to help B to make the verification? If yes what are the security constraints? $\endgroup$
    – Ievgeni
    Commented Jun 29, 2021 at 9:33

1 Answer 1


Zero-knowledge proof seems fit with your goal. $A$ has to prove that it exists $M$ such that $C=Enc(M, pk_A)$, and $C^\prime=Enc(M, pk_B)$. This ZKP can be done without revealing any information about the data $M$ (that's why we call it Zero-Knowledge). For concrete instantiation you can use El Gamal encryption, and Groth-Sahai ZK-proof techniques :



Notice that you do not need to use private key of $B$ to verify the equality but if it is the contact which verifies, it's probably better.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.