# Prove data encrypted with different keys matches

Suppose user A encrypts some data using his public key and stores the data publicly. Later user A would like to transfer that same data to user B publicly by encrypting it using user B's public key.

What is the best way to verify that the same data was transferred to user B without knowing the data, user A, and user B's private keys?

• Is it homework? Commented Jun 29, 2021 at 9:21
• no, trying to figure out if this is possible at all and what I should read more about. Would like to create something of this sort on Ethereum so secret data can be transferred securely between people publicly. Commented Jun 29, 2021 at 9:23
• Question : Is it a deterministic encryption scheme? Commented Jun 29, 2021 at 9:24
• I don't know if this is possible at this point so it's too early to set any boundaries. Would be preferable if it's deterministic though. Commented Jun 29, 2021 at 9:27
• Other question : Is $A$ authorized to add new data (like ZK-proofs) to help B to make the verification? If yes what are the security constraints? Commented Jun 29, 2021 at 9:33

Zero-knowledge proof seems fit with your goal. $$A$$ has to prove that it exists $$M$$ such that $$C=Enc(M, pk_A)$$, and $$C^\prime=Enc(M, pk_B)$$. This ZKP can be done without revealing any information about the data $$M$$ (that's why we call it Zero-Knowledge). For concrete instantiation you can use El Gamal encryption, and Groth-Sahai ZK-proof techniques :
Notice that you do not need to use private key of $$B$$ to verify the equality but if it is the contact which verifies, it's probably better.