Overlapping theft windows

Rules 1 and 2 cover one stolen countersigner. This file checks what happens when two are stolen at once, using the same in-order pass.

Setup

• Countersigner A is stolen and forges a revocation of honest key K at log position 2. A's own revocation counts at position 6.
• Countersigner B is stolen and forges a revocation of K at position 4. B's own revocation counts at position 9.
• K makes cuts at positions 1, 3, 5, 7, 8 and 10.

Pass (each cut sees only events before it, per rule 2)

What this shows

• K is denied while any forged revocation still counts, so the denied span is the union of the windows: (2, 6] ∪ (4, 9] = (2, 9].
• Recovery is still forward-only: cut 10 counts again and no earlier cut is recomputed. Revoking A at 6 did not restore cut 7, because B still counted.
• Worst-case loss is bounded by the length of the union, here 9 − 2 = 7 positions, not by the sum of the separate windows (4 + 5 = 9). The bound in rule 1 holds per window; for several thefts the bound is their union.

Recovery trace: one in-order pass, no retroactive change

A worked example of rules 1 and 2. It checks that a later log event restores a pulled cutoff without editing any earlier verdict.

Setup

• Honest key H makes cuts at log positions 2, 4, 6, 8, 10.
• Countersigner C is stolen at position t = 3.
• The forger signs a revocation of H as C at position 3.
• C's real owner notices and revokes C at position p = 7.

Pass, in log order

Checks

• Fixedness (rule 2): the verdicts at 4 and 6 were decided before position 7 and stay denied. Position 7 changes only verdicts after it.
• Loss: 2 denied cuts. Both fall in (t, p] = (3, 7], which has 4 positions. That matches the worst-case bound p − t.
• Recovery: H gets its cutoff back at p without any recomputation. One in-order pass gives the final answer.

Open edge

What happens if a cut and C's revocation land at the same position p? Then the inclusion at the closed end of (t, p] decides the outcome. Rule 2 says "events before q," so a cut at q = p does not see the revocation and is still denied. The bound p − t therefore includes p.

Theft-window worst case under rules 1 and 2

Setup: honest key H, countersigner C. C's key is stolen at log position t; C's own revocation first counts at log position p (t < p). Forged revocations of H, countersigned by stolen C, can land anywhere in [t, p).

Walk-through (one in-order pass)

• Rule 2: each H cut at q is judged once from events before q. Cuts in (f, p) were judged while the forgery counted, so they stay denied.
• Rule 1: from p on, forged revocations signed by C stop counting, so H's cutoff recovers at p. Nothing before p is recomputed.

Worst-case count

The forger's best move is f = t (forge immediately). Denied cuts are then H's cuts in (t, p]: at most p - t positions, and exactly the number of H cuts the log holds in that interval. The bound depends only on detection latency p - t, not on how many forgeries are issued: a second forgery in the same window denies nothing the first did not.

Answer to the direction

Yes, recovery is forward-only at p with no retroactive recomputation. The window denies at most H's cuts inside (t, p]; shrinking p - t (faster countersigner revocation) is the only lever that reduces it.