A new preprint describes a way for two people to co-sign a document without a network connection at signing time, a server carrying the signed data or a certificate authority. The proposed system is designed so an outside verifier can later check both signatures and whether the signing keys came from attested hardware.
The system models two mobile devices, an initiator called DA and a responder called DB. Each device has a secure element, camera and display, and the exchange runs visually from DA to DB and then back from DB to DA.
Two optical turns
The central design uses a two-stage hash anchor, a digest used to tie signed fields together. The paper specifies that h2 is a deterministic function of h1. It says this keeps the first signature valid after the second signer joins, without a re-signing round, and moves the described exchange from three rounds to two optical turns.
The signatures are chained together. The second signed message contains the first signer’s public key and first signature, binding the second signature to one specific earlier signature.
Hardware provenance is carried alongside that chain. The transfer structure includes the full hardware-attestation token from the first device, while a context-separated digest of the token enters the signed anchor set.
Built for a lossy visual channel
Because the channel is optical and one-way at each turn, the protocol uses compressed, rateless framing. The transfer is split into base fragments of at most 675 bytes, with a redundancy factor of 3. The framing description says lost frames do not require a back-channel, although the paper reports no measurements of optical loss, throughput, latency or decoding reliability and makes no claim that its degree rule is optimal.
The reported implementation combines iOS and Android support with ECDSA P-256 signatures, Secure Enclave and StrongBox hardware, SHA-256, Apple App Attest and Play Integrity, and an LT-style fountain code. A standalone verifier recomputes the two anchors and the final digest, checks both signatures without network access, and reports byte-for-byte agreement between the Dart client and an independent Python verifier.
Formal guarantees, not deployment results
The security section defines four formal properties and models the secure element as an ideal signing oracle. Three theorems and a proposition connect the claimed protections to cryptographic and attestation assumptions. The anchor-binding theorem depends on collision resistance of the hash function and injective field encoding on the allowed input domain. The co-signature theorem depends on EUF-CMA security, a standard condition intended to limit signature forgery.
The provenance and no-replay proposition depends on sound hardware attestation and collision resistance, while the tamper-evidence theorem depends on collision resistance and EUF-CMA security. These are reductions, meaning the paper bounds the protocol’s claimed advantage by the assumed cryptographic or attestation advantages. They are not estimates of attack rates from real-world testing.
The encoding result also has a technical boundary. The escaped format is injective only on an admissible domain, so the paper assigns an unconditional injectivity statement to a type-length-value alternative. That caveat matters because the binding argument relies on different valid inputs producing different encoded values before hashing.
Trust has moved, not disappeared
The protocol does not eliminate trust. Its provenance claim shifts an important part of it from a certificate authority to the hardware manufacturer and its pinned roots. A compromised manufacturer root could undermine provenance, and attestation strength varies by platform. Devices without secure elements or development environments do not receive the full hardware-origin guarantee.
The hardware provenance claim is not a claim that a key belongs to a natural person. Duress, coercion and rooted or jailbroken malware that can drive biometric prompts are outside the stated scope, and the paper says its duress flag is not integrity-protected. Its reference deployment performs server-side attestation verification during onboarding, so the text does not establish that onboarding itself is fully server-free.
The paper deliberately excludes display-file rendering bytes from the cryptographic anchor. It also reports that no independent third-party security audit has yet been performed.
Still an early technical proposal
The paper’s worked example uses synthetic, non-personal inputs that can be recomputed with the reference verifier. That makes the example reproducible, but it does not supply evidence from human participants, a deployment cohort or a benchmark dataset.
The remaining tests are practical ones: measuring optical reliability and decoding performance, comparing the custom framing rule with optimized rateless-code designs, and validating platform-specific attestation and manufacturer roots over the system’s lifecycle. Legal acceptance and application-level person identity binding are outside the analyzed protocol.
The document is an arXiv v1 preprint dated 25 August 2026. It presents a working implementation and conditional formal security claims, but the supplied evidence does not show legal validity, equivalence to a qualified or PKI signature, resistance to coercion or production security after an independent audit.
Paper data and sources
Original title: CA-less Mutual Co-Signing of Documents over a Unidirectional Visual Channel with Transported Hardware Attestation
Authors: Dmytro Diikun
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text