@goodvibration is right. From the comment, this appears to be more a signature verification problem. It would be much lighter to use ecrecover:

• You want to verify the encryption result is generated by a particular public key.
• One solution, as you have suggested, is to let every node re-execute the encryption and compare. (note the gas cost is unlikely to be cheap)
• An alternative solution:
  1. Encrypt as usual.
  2. Use the same public key to generate a signature for the encryption output. (As suggested by the above-linked post, you may need to hash the encryption output to make it 32 bytes)
  3. The resulting r, s, v are saved in the blockchain.
  4. That is it. Now everyone can verify with the saved info. First, hash the encryption output (to get the 32 bytes). Second, use ecrecovery with the saved r, s, v, the result is an address, which can be compared against by the public key's associated address (see more here)

@goodvibration is right. From the comment, this appears to be more a signature verification problem. It would be much lighter to use ecrecover:

• You want to verify the encryption result is generated by a particular public key.
• One solution, as you have suggested, is to let every node re-execute the encryption and compare. (note the gas cost is unlikely to be cheap)
• An alternative solution:
  1. Encrypt as usual.
  2. Use the same public key's paired private key to generate a signature for the encryption output. (As suggested by the above-linked post, you may need to hash the encryption output to make it 32 bytes)
  3. The resulting r, s, v are saved in the blockchain.
  4. That is it. Now everyone can verify with the saved info. First, hash the encryption output (to get the 32 bytes). Second, use ecrecovery with the saved r, s, v, the result is an address, which can be compared against by the public key's associated address (see more here)