[1] In this scheme, a signer possessing a private key can publish a signature of a message.
The disavowal protocol distinguishes these cases removing the signer's plausible deniability.
They achieve this by having the property of zero-knowledge; both parties can create transcripts of both confirmation and disavowal that are indistinguishable, to a third-party, of correct exchanges.
Alice wishes to convince Bob that z is not a valid signature of m under the key, gx; i.e., z ≠ mx.
If Alice attempts to cheat at step 3 by guessing s at random, the probability of succeeding is 1/(k + 1).