Verify hash of plaintext through ciphertext Suppose that Alice runs a paid archival service.


Bob wants to download a well-known plaintext M with hash H(M) from Alice by sending her the hash.
Alice does not want to send M to Bob without Bob paying and Bob does not want to pay unless Alice sends him the real thing.
Thus, Alice encrypts M with some temporary key K into: E(M, K) and sends that to Bob alongs with H(K).
Bob checks that E(M, K) is indeed M encrypted with K, knowing only {E(M, K), H(K), H(M)}.


Is step 3 possible under some crypto system?
Answering in a pragmatic way (it might help, depending on the background of the question):

Even if step 3 is possible, it does not matter, since this will not add any additional security value. 

Because: Bob still has to trust Alice that she will send him K in case that he pays the money. So Bob could also simply trust Alice, that she has already send him the correct encrypted text E(M, K) in the first place.