Ark-0 · Signature lab
Post-quantum signature lab
Sign a text with Schnorr and with ML-DSA-44, right in this browser, and compare the sizes and the times. Then change one byte and see the check fail.
Making two key pairs in this browser…
The lab has not started. If the page stays like this, the browser may be too old for it or may block its script. Please try a current browser.
About this page
This page is for trying things out only. Both key pairs are made when the page opens and live only in its memory: they are not stored, they never leave this browser, and a reload makes new ones. They belong to no address; do not use them to receive coins, since a reload discards them.
Nothing signed here can serve as a transaction signature: the keys are this page's alone, and the two signatures use this page's own context string and tag, shown on their cards, not the ones the wallet's transaction signatures use.
ML-DSA-44 is a lattice signature that NIST standardized in FIPS 204. Its public keys and signatures are far larger than Schnorr's, and a larger signature makes a larger transaction, which takes more block space and pays a higher fee. One in the explorer: an ML-DSA-44 spend with one input and one output, 1,044 vB.
The signatures come from noble's JavaScript libraries: @noble/curves for Schnorr, which has been audited independently, and @noble/post-quantum for ML-DSA-44, which only its author has audited. Neither is a constant-time implementation, so neither is fit to protect real assets.
Migration-readiness declaration
One sentence, which you can sign with a key derived from your Ark-0 wallet. Every signature is published; this page shows how many public keys have a valid signature.
我支持现在就为比特币的后量子迁移做准备：在可验证的量子进展出现之前，把迁移路径、工具和演练做好，并公开每一步的证据。I support preparing Bitcoin for a post-quantum migration now: having the migration paths, tools and drills ready before verifiable quantum progress arrives, and publishing the evidence for every step.- Declaration hash (SHA-256)
- 5f31541e61ae97f8b22437a6c4e1a66440012a42dc02ecd3522d0a22cbe99350
- Public keys with a valid signature
- 0
Before you sign
- The public key, the signature, the action and the hour the server took it are all published. Revoking stops a signature from counting; nothing is deleted from the record.
- One person can make many keys, so the number is not a number of people, and the operator can sign with keys of its own too.
- Signing is not anonymous: the operator and the network's proxies may link a signing request to the wallet activity of the same browser.
- This page shares its origin with the wallet, so a script of this site can reach the wallet's seed: the same risk as on the wallet's own page.
- It affects no entitlement. It is done on a test site.
Reading the wallet in this browser…
This part has not started. The browser may be too old for it or may block its script.
The public record
Every accepted signature and revocation is in declaration.json, with what it takes to check them offline: rebuild each event's message, check its signature with the fixed context string and its work against its d, let a valid revocation outweigh a signature, and count each other public key with a valid signature once. declaration.json
A signature shows only that some key authorized this sentence: not that its holder is a distinct person, nor who they are, and the operator can sign with keys of its own. A copy of declaration.json shows that its signatures and its count agree; it cannot show that it is complete, since the operator could leave records out. Whoever keeps copies can tell when history they saw is changed later, but not records that were never published. v1 is not anchored on any chain.