Signature Gate / Research experiment 02

Can Carol prove Alice signed it?

Alice signs a fictional agreement. Bob wants proof it is valid. Carol is the designated confirmer. Watch the signer and confirmer each use actual mathematical equations to answer Bob's challenge.

RESEARCH ONLY — THIS IS NOT SECURE CRYPTOGRAPHY OR A FINISHED DESIGNATED CONFIRMER SIGNATURE. The group here is a symbolic teaching model: its public numbers expose the private exponents, so secrecy, zero knowledge and non-transferability do not hold. We are reproducing the algebra of Xia's 2013 Chapter 5 source, which is a different construction from the 2016 scheme still under review.

01 / Alice signs

Create a signature

The underlying BLS-shaped signature and its signed encryption are calculated; this uses abstract group arithmetic, not a real pairing library.

No keys or signature yet.

02 / Carol or Alice proves

Ask for mathematical evidence

Carol can answer for the designated confirmer key. Alice can answer for the signer key. Bob independently checks the same five proof equations.

No proof transcript yet.

The signer and confirmer can each prove a source-defined relationship using an interactive OR proof.

03 / Try to cheat · The challenge order matters

Can Eve fool Bob without Alice or Carol's secret key?

Eve changes Alice's statement. She cannot honestly confirm the forged statement. But what if Eve chooses Bob's challenge before writing her first proof message? Try the actual symbolic arithmetic, not a canned animation.

1 · Eve picks a challengeShe knows the answer Bob is supposed to choose later.
2 · Eve fabricates proof numbersShe computes the first message backward from that challenge.
3 · Bob tests the arithmeticSee what happens when he uses Eve's number instead of choosing his own.
Your prediction: Will the forged proof pass Bob's arithmetic check when Eve chooses his challenge first?

Issue Alice's symbolic signature to unlock the attack experiment.

Predict first, then see the independent verifier's computed result.

Inspect Eve's actual forged transcript and Bob's five equation checks
No attack transcript yet.

This is a deliberately incorrect message order in a toy group of order 1019. The arithmetic may pass when Eve picks the challenge, but that does not establish a valid three-message proof. A proper verifier must send a fresh unpredictable challenge after the prover commits. Nothing here is a secure designated confirmer signature.

04 / What's still missing?

Rejecting a proof is not proving a signature was forged

The published scheme also requires an affirmative disavowal proof. This experiment does not implement disavowal. When Alice or Carol cannot prove validity, Bob has learned nothing conclusive about invalidity. We will not substitute a status button for the missing proof.

Inspect the source equations and security limits
  • Source: Fubiao Xia, 2013 thesis, §5.5 and Figures 5.1–5.4. The actual issuing structure is signed ElGamal over BLS signatures; OR confirmation is shown in Figures 5.1 and 5.2.
  • The symbolic pairing computes exponent products modulo 1019. Everybody can see those exponents. It cannot protect a signing key.
  • Confirmation tests a mathematical relation. It does not check whether the real-world words in Alice's agreement are true.
  • Disavowal Figures 5.3/5.4 require further independent checking. As transcribed, a displayed non-identity ratio appears to be the identity by the source's own public-key definition. The workbench does not invent a correction.
  • The 2013 OR proof alone does not establish concurrent zero knowledge or transferability restrictions; those need the published compiler and its formal security proof.