Confirmer Signatures — Crypto Lab (Research Gate)
Current research status (2026-10-18): The real BLS12-381 workbench computes issuance, signer/confirmer confirmation, and a candidate affirmative inequality proof. The candidate correction argument now gives completeness, two-special-soundness and special honest-verifier zero knowledge for the specified prime-order protocol, supported by executable witness extraction. These are local research results, not an independently verified correction of the complete published DCS scheme. Full DCS security remains unestablished. The owner authorized a separate Advanced · Research Preview catalog card on 2026-10-18; that listing does not certify the complete scheme.
Catalog entry: Signature Gate is an Advanced research-preview demo under Public-Key & Signatures. The project entry URL opens the real-pairing workbench; the earlier ordinary-signature comparison and symbolic model remain available.
The visitor now becomes Bob: The real-pairing workbench has a four-step guided story, explicit commitment → challenge → answer controls, an altered-claim experiment, and Eve’s passing recording beside its rejection under a different challenge. Explore mode opens all experiments; the evidence view provides public transcript downloads and the review packet.
Reproducible verification: A separate Python/py_ecc verifier checks the same public transcripts using a different cryptographic library. CI reproduces fixed vectors, checks polynomial identities and 100,972 small-field extraction cases, tests tampering and verifies actual browser exports. This is not independent expert review or a machine-checked full security proof.
Kernel-checked mathematics: The Lean 4 proof project proves completeness, explicit witness extraction and OR two-special-soundness in a field model, including the crucial nonzero denominator. It also proves the exact joint honest-branch sampling distribution. Fourteen declarations pass a restricted axiom gate; Pages publication now requires that proof check on the same commit. Concrete BLS12-381/code refinement, the full OR distribution and full DCS security games remain outside the formalization.
Security repair: Proof work exposed a vacuous subgroup check: reducing the group-order exponent to zero let an order-two element support a false denial of a valid signature for even challenges. The verifier now uses raw subgroup exponentiation and validates group membership. The new regression reproduces that attack and requires rejection. This is why passing honest examples alone was insufficient.
Designated-verifier proofs (A-D-09): The real-pairing workbench now has a fifth chapter implementing the non-interactive designated-verifier proof of Jakobsson, Sako and Impagliazzo, EUROCRYPT '96, LNCS 1070, pp. 143–154, §5. The same verifier accepts a proof made by the signer or confirmer with the branch witness and a proof the visitor forges with the secret behind their own verifier key. From the transcript alone, an outsider therefore cannot establish statement truth or proof origin; the visitor can even produce an accepting proof of a statement Alice never signed. A separate publicly verifiable Fiat–Shamir proof of the same relation supplies the transferability contrast, and neither verifier accepts the other's proofs. Any reader can recompute that public proof's equations, but this lab supplies no proof-of-knowledge or soundness theorem for it. The two designated-proof origins are shown to be exactly interchangeable on a true statement through the bijection that maps prover randomness to simulator randomness, checked by reproducing proofs byte for byte rather than by sampling. A separate py_ecc implementation recomputes every equation, and eight source mutations are each killed by their own named test in CI. Scope, the random-oracle model, and all six deviations from the printed construction are recorded in DESIGNATED-VERIFIER.md. This is Definition 1, not the Appendix's strong designated verifier, and it changes nothing about the open full-DCS obligations.
Reading the history below: Earlier symbolic and 2016-oriented experiments remain available, but they are separate constructions. Current real-pairing claims and remaining obligations are recorded in the security ledger.
New source-specific research, kept separate from the 2016 construction: XIA2013-UNIFIED-CONFIRMATION.md documents the signed-ElGamal/BLS-shaped issuing algebra and both interactive OR-confirmation diagrams from Xia's 2013 Chapter 5. The working browser workbench computes each value, samples Bob's challenge after the prover commits, and verifies public equations, including altered-message failures. It uses exponent-visible symbolic groups (not a real pairing), so its keys are openly recoverable and it proves no zero knowledge or non-transferability. The printed affirmative disavowal diagrams contain an apparent non-identity inconsistency requiring source review; the symbolic path is not a secure disavowal implementation; the separate real-pairing candidate and its proof argument are linked above. This symbolic research does not complete the 2016 DCS; the catalog card describes the separately scoped real-pairing research preview.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
