Plaintext-Checkable Encryption