Consider a public key cryptosystem function E that transforms a plaintext message M into a ciphertext C = E(M). An individual A wishes to prove to an individual B that A can produce M given only C, but A does not wish to divulge to B either the plaintext M or the method by which A produces M from C.

The solution presented for RSA cryptosystems is to factor the encryption exponent e into k &dundot; m; this factoring is agreed upon beforehand by A and B. A, having produced M from C, sends P = M^k mod n to B. By raising P to the mth power, B should obtain C, demonstrating that A was in possession of M. The solution for the discrete logarithm problem is completely analogous.