💻 computer science

CA-less Mutual Co-Signing of Documents over a Unidirectional Visual Channel with Transported Hardware Attestation

This paper presents and analyzes a CA-less protocol enabling two mobile devices to mutually co-sign documents over a unidirectional, lossy visual channel by transporting hardware-attested keys via fountain codes and employing a novel two-stage hash anchor to resolve circular signing dependencies, thereby achieving secure offline verification without intermediary servers.

Original authors: Dmytro Diikun

Published 2026-08-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Dmytro Diikun

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of digital agreements, trust usually relies on a vast, invisible infrastructure. When two people sign a contract on their phones, they depend on a network of servers and a central authority known as a certificate authority to vouch for their identities. This system works well when everyone is connected to the internet, but it collapses the moment the network goes down or when the parties want to keep their transaction completely private from any central server. Without these digital notaries, there is no standard way to prove that a public key truly belongs to the device holding it, nor is there a reliable method to ensure that two people have genuinely agreed to the same terms without a third party watching over them.

This is the specific problem researchers Dmytro Diikun has tackled: how can two people, standing face-to-face with their phones, create a binding, mutually signed document without any internet connection, without a central server, and without a certificate authority? The solution requires overcoming a fundamental logical puzzle. In a normal signing process, each person needs to see the final document, including the other person's signature, before they sign it. But neither person can sign until the other has signed first. It is a circular dependency that usually requires a server to break the deadlock. Furthermore, without a central authority, there is no way to prove that the digital key being used was actually generated inside a secure, genuine piece of hardware, rather than being a fake key created by a malicious software program.

The paper describes a new protocol that solves these problems by turning the phones themselves into the entire trust network. The two devices communicate using only a one-way visual channel: one phone displays a rapidly changing, animated code on its screen, and the other phone reads it with its camera. This channel is slow and prone to errors, much like trying to read a flickering sign in the wind, but it is sufficient for the task. The core innovation is a two-stage process that breaks the circular dependency. The first person commits to the document's terms and creates a digital seal based on those terms alone, before they even know who the second person is. This seal acts as a fixed anchor. When the second person joins, they take that existing anchor, add their own identity to it, and create a new, combined seal. Because the second person's action is mathematically tied to the first person's specific seal, the first signature remains valid and unbroken. The second signature is then chained to the first, making it impossible to separate the second person's agreement from the specific document the first person signed.

To ensure that the keys used are genuine, the protocol transports a full hardware attestation token directly between the phones. This token is a digital certificate generated by the phone's secure hardware, proving that the key was created inside a genuine, tamper-resistant chip and not by software. Because this token is too large to fit into a single static image, the researchers use a rateless coding method to break it into many small fragments. These fragments are sent as part of the animated visual stream. The receiving phone collects enough fragments to reconstruct the full token, verify that the key comes from genuine hardware, and then bind that verification directly into the final signature. This means the proof of identity travels with the document itself, allowing a third party to verify the entire chain of trust later, completely offline, without needing to contact the phone manufacturer or any server.

The researchers have built a working version of this system on both iOS and Android devices, using the secure chips built into modern phones. They demonstrated that two phones can exchange the necessary data, generate the signatures, and produce a document that a third-party verifier can check entirely offline. The verifier can recompute every step, confirm that the signatures are mathematically linked, and verify that the keys were generated in genuine hardware, all without ever connecting to the internet. The study proves that it is possible to achieve a high level of cryptographic security and mutual agreement even when the standard infrastructure of the internet is removed. However, the author is careful to note that this system does not replace the legal status of a signature or prove that the person holding the phone is who they claim to be; it only proves that the digital keys are genuine and that the two parties have cryptographically bound their agreements together. The trust shifts from a central authority to the hardware manufacturer, and the system relies on the assumption that the manufacturer's roots of trust have not been compromised.

This approach represents a significant shift in how digital trust is established. Instead of relying on a network to validate identities in real-time, the protocol embeds the proof of identity directly into the transaction, carried across a simple, one-way visual link. It shows that even with a slow, lossy connection and no central server, two parties can create a record that is mathematically inseparable and verifiable by anyone, anywhere, at any time. The work does not claim to be a perfect solution for every legal scenario, but it successfully demonstrates a new pathway for secure, offline collaboration that was previously thought to require a constant connection to the digital world.

Technical Summary: CA-less Mutual Co-Signing of Documents over a Unidirectional Visual Channel with Transported Hardware Attestation

Problem Statement
The paper addresses the challenge of enabling two mobile devices to mutually co-sign a document under three strict constraints: (1) no network connectivity at the time of signing, (2) no intermediary server on the trust path, and (3) no reliance on a Certificate Authority (CA) to vouch for public keys. The only available communication channel is a unidirectional, lossy, low-bandwidth optical link (e.g., one device displaying an animated code read by the other's camera).

The author identifies two primary technical hurdles in this setting:

Circular Dependency: In basic interactive co-signing, Party A cannot sign the "final document" because it lacks Party B's identity and signature, yet Party B cannot be bound until Party A has signed.
Key Trust without CA: Without a network or CA, a receiver cannot validate a certificate chain. The system must establish trust in the sender's public key solely through the device itself.

Methodology
The proposed protocol achieves mutual co-signing and key provenance through a combination of cryptographic anchoring, signature chaining, and hardware attestation transport.

Two-Stage Hash Anchor: To resolve the circular dependency, the protocol employs a two-stage hash mechanism.
- Stage 1 ( $h_1$ ): The initiator (Party A) computes a hash anchor $h_1$ over the canonical document content and their own identity fields before Party B is known. Party A signs a message $m_A$ containing $h_1$ .
- Stage 2 ( $h_2$ ): When Party B joins, they compute a second anchor $h_2$ as a deterministic function of $h_1$ and their own identity fields ( $id_B$ ). Party B signs a message $m_B$ that includes $h_2$ , Party A's public key ( $pk_A$ ), and Party A's signature ( $\sigma_A$ ).
- This structure ensures $h_1$ remains valid after $h_2$ is computed, collapsing the exchange from three rounds to two optical turns.
Signature Chaining: The second signature ( $\sigma_B$ ) is cryptographically bound to the specific first signature ( $\sigma_A$ ) by including $pk_A$ and $\sigma_A$ within the message $m_B$ . This prevents "re-pasting" a valid signature onto a different document or a different first signature.
Transported Hardware Attestation: To replace CA-based trust, the full hardware attestation token (e.g., Apple App Attest or Google Play Integrity) is transported point-to-point over the visual channel.
- The token cryptographically binds the public key to a genuine secure element (Secure Enclave/StrongBox).
- Because a full attestation token exceeds the capacity of a single static optical code, the protocol uses a rateless (fountain) code (specifically an LT-style construction) to fragment and transmit the token over the lossy channel without requiring a feedback loop.
- The hash of this token is bound into the final verification structure.
Verification: A third-party verifier can reconstruct all anchors ( $h_1, h_2$ ) and verify both signatures and the attestation tokens entirely offline. The verification process recomputes the composite hash from a 39-field record containing keys, signatures, biometric flags, device token hashes, and content anchors.

Key Contributions

Two-Stage Hash Anchor: A construction that provably removes the circular signing dependency while keeping the first signature stable, reducing the interaction to two optical turns.
Signature Chaining Rule: A mechanism ensuring the second signature is inseparable from a specific first signature, preventing signature substitution attacks.
CA-less Key Provenance: A method for transporting full hardware attestation tokens over a visual channel and binding them to the signature, allowing offline verification of key origin (genuine hardware vs. software key).
Engineering Instantiation: A working implementation on iOS and Android using ECDSA P-256, SHA-256, and fountain codes, accompanied by a standalone, network-free verifier.

Results and Security Analysis
The paper defines and reduces four security properties to standard cryptographic assumptions:

Anchor Binding: Reduces to the collision resistance of the hash function $H$ and the injectivity of the canonical encoding.
Co-signature Inseparability: Reduces to the EUF-CMA (Existential Unforgeability under Chosen Message Attack) security of the underlying signature scheme.
Attestation-Bound Key Provenance: Reduces to the soundness of the attestation scheme and the collision resistance of $H$ .
Post-Signing Tamper Evidence: Reduces to the EUF-CMA security of the signature scheme and collision resistance of $H$ .

The author reports a successful instantiation where a third-party verifier recomputes all anchors and checks both signatures fully offline. The implementation includes strict checks to ensure keys are generated within secure elements, rejecting software fallbacks.

Significance and Scope
The paper claims that this construction demonstrates how mutual co-signing and verifiable key provenance can survive the complete removal of standard infrastructure (network, servers, and CAs). The novelty lies not in the individual components (multi-signatures, attestation, fountain codes) but in their specific composition and the mechanisms (two-stage anchor, chaining) that make them work under these constraints.

The author explicitly states the scope and limitations:

Not a PKI Substitute: The scheme does not replace PKI or qualified electronic signatures; it maps out the limits of verifiability when infrastructure is removed.
Device vs. Person: The attestation binds a key to genuine hardware, not to a natural person. Binding a key to a real-world identity is an application-layer step outside the protocol's cryptographic core.
Trust Relocation: The scheme does not eliminate a trusted party but relocates trust from a CA to the hardware manufacturer's attestation root.
No Legal Claim: The paper makes no claims regarding the legal status of the output in any jurisdiction.
Out of Scope: The protocol does not address coercion, duress, or malware on rooted/jailbroken devices that can bypass biometric prompts.

The work is presented as a preprint (August 2026) with a pending patent application, and the author notes that independent third-party security audits are a prerequisite for high-assurance deployment.

Technical Summary: CA-less Mutual Co-Signing of Documents over a Unidirectional Visual Channel with Transported Hardware Attestation

More like this