How to verify a number encrypted with an unknown key Alice and Bob are going to follow the protocol below.  Are there any crypto-constructions to help Bob verify the correctness of the answer he gets?:


Alice encrypts a set of numbers using some cryptosystem and a secret key (e.g. Paillier crypto-system).
Bob multiplies the ciphertexts to obtain an encryption of the sum of numbers.
Bob sends to Alice the ciphertext for the sum. Alice decrypts the sum with her secret key and then encrypts the sum with a key known by Bob.
Bob receives the sum encrypted with his key and decrypts it successfully.


Question: how can Bob verify that Alice didn't change the sum to a different number before re-encrypting?  Is some sort of zero-knowledge proof helpful?
You probably don't need to re-encrypt using the Paillier crypto system.

1) Alice encrypts $c_1=g^{m_1} r_1^n$ und $c_2=g^{m_2} r_2^n$ and computes $r_3=r_1 \cdot r_2$ and $m_3=m_1+m_2$, then sends $c_1$, $c_2$, $m_3$ and $r_3$ to Bob

2) Bob computes $c_3=c_1 \cdot c_2=g^{m_3} r_3^n$ - If the homomorphically computed sum matches the re-encryption Bob will believe that $c_3$ encrypts $m_3$

The basic idea is that $g^{m_1} r_1^n \cdot g^{m_2} r_2^n = g^{m_1+m_2} (r_1 \cdot r_2)^n$

All cipher text operations are executed modulo $n^2$

This proof is backed up by Paillier's original paper.
Unfortunately the proof is not absolutely Zero Knowledge as the sum may give you information about the possible summands. However you may choose large similarly sized primes for the $r$s so an attacker would need an efficient solution for prime factorization (see other question here).