Testing

ringsign.pv

attacker[active]

principal Alice [
    knows private a
    ga = G^a
]

principal Bob [
    knows private b
    gb = G^b
]

principal Carol [
    knows private c
    gc = G^c
]

Alice -> Bob: [ga]
Alice -> Carol: [ga]
Bob -> Alice: [gb]
Bob -> Carol: [gb]
Carol -> Alice: [gc]
Carol -> Bob: [gc]

principal Bob [
    knows private m
    s = RINGSIGN(b, ga, gc, m)
]

Bob -> Damian: [ga], [gb], [gc], m, s

principal Damian [
    _ = RINGSIGNVERIF(ga, gb, gc, m, s)?
]

queries [
    authentication? Alice->Damian: m // Error: query depends on Alice sending a constant (m) that they do not know.
    authentication? Bob->Damian: m
    authentication? Carol->Damian: m
]