Properties of PPTK

• If S* proper (C=ER(M)) then S* can prove PlainText Knowledge.

• With probability > 1-(7/8)n, S* can compute DR’s output on her own:

  • If DR outputs M=DR(C) then S* can compute M on her own.
  • If DR outputs “bad proof” then S* knows this in advance.