Protocol workshop · Historical reference: Schneier (1996), §§5.7–5.9 · Intermediate

Who has to go first?

Two valid signatures. Two willing parties. One opportunity to walk away.

Trade a message for a receipt, exchange contract signatures, or exchange secrets. Interrupt each run and inspect what each side actually received.

Choose the exchange

Alice

Preparing…

Intermediary

Preparing…

Bob

Preparing…

Generating this session's keys and synthetic items…
    Inspect delivered evidence and signatures
    No evidence delivered.

    Changing either selector starts a fresh experiment. Resetting this page does not model erasing information someone already received.

    Three experiments to try

    1. Direct delivery: Alice sends, then stop. Bob keeps the delivered item. Can Alice recover it by deleting her copy?
    2. Trusted intermediary: deposit only Alice's item, then abort. Start again, deposit both, and release. Compare the evidence held by each party.
    3. Broken evidence: corrupt Alice's signature before submission. A failed verification must block the deposit or direct delivery.

    Fairness is a protocol property

    Signature verification checks the signed bytes under a public key. Fair exchange asks whether an honest party can obtain the promised counterpart when the other party obtains theirs.

    The receipt here authorizes release of the bound message; it cannot prove that a human read or understood it. Contract signatures cover the same fictional terms. The secret exchange concerns both parties receiving one another's secret; it differs from oblivious transfer, where a receiver privately chooses among a sender's messages.

    What the intermediary adds

    This model makes one irreversible decision per session: abort or release. Release makes both verified items available for retrieval. It does not require two network packets to arrive at the same instant. After either decision, contradictory operations are rejected.

    All parties and keys live in this browser. Actual WebCrypto ECDSA and AES-GCM verify and open the items; availability, identity, custody and the intermediary's durable decision log are simulated. Real services need those properties to hold across crashes, replay, malicious clients and network failures.

    How optimistic fair exchange differs

    Optimistic protocols involve the trusted third party only when the ordinary exchange fails. They need carefully constructed recoverable evidence and compatible abort/resolve procedures. This workshop uses an always-involved ideal intermediary; it does not implement or claim to prove an optimistic protocol. A timeout alone cannot recall a secret that has already been disclosed.

    Sources and next steps