Confirmation
The witness satisfies C = x·D and A = B^x. For each branch, Bob checks:
z_key = b·D + c·Cz_pair = B^b · A^cThe prover fixed both z values before Bob’s challenge.
Four short experiments. Make a prediction, choose a challenge, and see what the mathematics establishes.
A
AliceHer signing key stays private
C
CarolHer confirmer key stays private
B
Bob YOUYou have no proof yet
E
EveCan fabricate a recording
01 / The agreement
Start with something worth checking.
Alice signs a fictional statement and encrypts the signature for Carol. You will check a claim about that signature—not whether the words are true.
Ready. No signed object has been created.
03 / A different claim
Same signed object. Different words.
ALICE SIGNED
Create an agreement first.
The original claim is still in use.
A refusal, silence, or failed check is not affirmative proof of invalidity. Try confirmation below, then the separate inequality proof.
02 / You control the challenge
Make the prover answer you.
Create an agreement first.
- 1CommitmentProver fixes the first message
- 2Your challengeFresh randomness, chosen afterward
- 3Answer & checkPublic equations decide the result
Receive a commitment before choosing your challenge.
YOUR FRESH CHALLENGE
What do Bob’s equations check?
Each OR branch uses a different role key. C is that public key, D its group generator, and x the private scalar. A is derived from the encrypted signature; B from the message hash and the other role’s public key. Bob reconstructs these values from the public object.
Candidate disavowal
The witness satisfies C = x·D and A ≠ B^x. For each branch, Bob checks:
z_key = u·D − v·Cz_pair = β^c · B^u / A^vβ must be a nonidentity element of the order-q target group. This condition is checked, not assumed.
The two branch challenges must add to Bob’s challenge: c₁ + c₂ = c (mod q). All scalar arithmetic is modulo the BLS12-381 subgroup order. Point equations use addition; target-group equations use multiplication.
A prover knows one role secret and simulates the other branch. The public equations check both branches. See the evidence view for the exact derivation and the security properties this does not establish.
Follow the actual public values
No proof transcript yet.
04 / The convincing fake
A passing recording. A failing live answer.
Eve knows neither private key. She invents a confirmation transcript for a changed claim by choosing the challenge before constructing the commitment.
Not created yet
Eve will pick responses and a challenge, then calculate a matching commitment.
You have not challenged it
Keep Eve’s commitment and answer fixed. Give her recording a different challenge.
Make your prediction first.
Inspect the side-by-side equation checks
No recording yet.
YOU FOUND THE DISTINCTION
The order of events is part of the proof.
Eve fabricated a recording; she did not answer Bob’s independent challenge. That is why an equation-valid screenshot is not evidence of a live exchange.
This illustrates transcript simulation. It does not establish the full scheme’s non-transferability or malicious-verifier security.
The evidence desk
Inspect the claim. Reproduce the check.
Check the computations, the formal mathematical model, and the remaining review questions.
Kernel-checked mathematics
For one fixed commitment, two accepted answers to different challenges must reveal a witness to the candidate inequality relation. A proof checker verifies this for every field value allowed by the model.
The formal model also checks honest-prover completeness and the exact joint sampling distribution for one branch. Publication requires these proofs to pass.
Read the theorem statements and reproduce the proofs ↗ · Check the publication run ↗
Scope: an abstract field model. The browser implementation, full two-branch simulation theorem and full DCS security are not formally verified. External expert review remains open.
Real computations
BLS12-381 issuance, signed ElGamal, both confirmation roles, and a candidate inequality OR proof.
Read the implementation ↗A second verifier
A separately implemented Python checker uses py_ecc, not the browser’s Noble verifier. Public fixed vectors and algebra certificates run in CI.
Run the reference checks ↗Independent review
The correction is not author-approved or independently audited. Full Type-3 DCS security and malicious/concurrent-verifier guarantees remain open.
Read the review packet ↗The remaining security questions
Full-scheme security. This Type-3 adaptation uses a dual-group key certificate and a candidate reconstruction of disavowal. The complete construction still needs a security proof; the kernel-checked field model covers particular claims.
Non-transferability. Bob should not be able to turn his interaction into convincing evidence for someone else. The recording experiment illustrates simulation; it does not prove this property for the complete scheme.
Dishonest verifiers and overlapping sessions. Privacy must survive a verifier who deviates from the protocol or coordinates several exchanges. The written special honest-verifier simulation argument does not establish those stronger guarantees.
These full-protocol properties have not been independently proved or audited. Inspect the assumptions and open obligations ↗
Your public transcript
Export a completed exchange for the second verifier. It contains public data, never role keys or private proof masks. An export cannot authenticate who selected its challenge.
Complete a proof exchange in the story first.
The proposed disavowal correction
The typeset thesis puts the nonidentity factor on a key relation that should be an equality. The local reconstruction moves that factor to the signature inequality and changes both verification equations accordingly.
Read the correction argument and attack regression ↗A candidate reconstruction with a scoped proof argument, not a publisher-verified correction of the complete protocol.
Follow the primary sources
Wang, Xia & Zhao (2011) — signed-ElGamal and unified verification.
Fubiao Xia (2013), Chapter 5 — source relations and disavowal figures.
Xia et al. (2016) — a different construction, not implemented here.
Camenisch & Shoup (2003) — separate verifiable-decryption building blocks.
Compare an ordinary public signature · Explore the deliberately insecure symbolic model
What has been checked? What still needs a proof?
Real cryptography. Experimental protocol. Built for learning and research.
This demo performs real elliptic-curve and pairing calculations in your browser. A separate verifier checks sample transcripts, and a proof checker verifies specific mathematical claims. These checks do not establish the security of the complete designated-confirmer signature scheme.
Use fictional statements only. Do not rely on this demo to protect information or settle real agreements.