The 3D version of this simulator maps every group element onto a single rotating ring and checks whether two markers land on the same angle. This 2D counterpart is a genuinely different, independently-computed model: instead of one ring, it draws the actual square-and-multiply algorithm that computes every modular exponentiation, bit by bit, as a ladder, and separately renders the real byte-level diffusion of the SHA-256 hash that produces the Fiat–Shamir challenge.
Sign(x, m):
r = random nonce in [1, q)
t = g^r mod p (ladder trace #1, blue)
c = H(t ‖ m) mod q (32-byte SHA-256 digest, stored)
s = r + c·x mod q
signature = (t, s)
Verify(y, m, t, s):
c' = H(t ‖ m_seen) mod q (32-byte SHA-256 digest, compared byte-by-byte to the signed one)
lhs = g^s mod p (ladder trace #2, cyan)
rhs = t · y^c' mod p (ladder trace #3, orange, +1 final "×t" step)
accept iff lhs = rhs
Each ladder is computed with the real left-to-right binary method: result = 1; for every bit of the exponent (padded to a fixed 31-bit width so all three ladders line up on the same x-axis) result = result² mod p, then result = result·base mod p if that bit is 1. The plotted y-value at each step is log2(result), so the ladder shows exactly how the exponentiation algorithm — not a re-projected ring position — walks toward the final value. It was checked against a plain iterative modpow over 500 random trials with zero mismatches.
The lower panel renders the real SHA-256 digest (via the browser's Web Crypto API) of the commitment concatenated with the message, as a 4×8 grid of its 32 bytes. Signing stores this digest; verifying computes a fresh one from whatever message verification actually sees and colors each cell by its Hamming distance (0–8 differing bits) from the signed digest. An untampered message reproduces the identical digest — every cell reads 0 — while flipping a single character anywhere in the message changes roughly half the bits of every byte (verified numerically: mean Hamming distance ≈126.2 of 256 bits across 50 trials, and a per-byte mean of 4.02 of 8 bits across 200 trials — textbook avalanche behavior), which is precisely why the ladder's cyan (g^s) and orange (t·y^c') traces snap apart the instant the message is tampered.
- Sign — draws a fresh random nonce r, computes commitment t = g^r mod p (plotting its full exponentiation ladder), hashes (t, message) to get c, and derives s.
- Verify — independently recomputes the challenge from (t, message actually seen), plots the g^s and t·y^c' ladders, and checks whether they land on the same final value.
- Tamper before verify — flips one character of the message that verification sees (the stored signature itself is untouched). Because the challenge depends on every bit of the hash, this desynchronizes the ladders and lights up the avalanche grid.
Where this deliberately differs from the 3D model: there is no ring and no angle here — the same p = 2³¹−1, g = 7 group and identical Fiat–Shamir equations are instead visualized through the literal bit-by-bit mechanics of modular exponentiation and the byte-level diffusion of the hash function, two views the 3D ring never exposes at all.