Is my protocol correct?
For fun, I tried to design a protocol that would allow off-the-record communication. I'm not sure it works, I have a feeling there might be a problem with it that I'm not seeing. Please tell me whether you see a problem with it.
Here's a dramatization of the protocol I'm imagining:
Alice wants to send a message to Bob such that Bob would know it was sent by Alice, but couldn't prove it to Dan.
Alice creates a disposable persona Charlie (an RSA keypair) and talks to Bob using Charlie.
Charlie: "Hello Bob! I wish to send you a message that you'll know is from Alice, but couldn't prove to anyone else!"
Bob: "Okay, here's a string X, it's the public key out of an RSA keypair I just randomly created, which I know for a fact you didn't tamper with."
Charlie: "Cool, I got X, but I'm not including it in this message. Here's Z, a random string I just came up with, which I know for a fact that you didn't tamper with."
Bob: "Cool, here's Y, which you can verify is the private key of X. Now let's take (Y xor Z) to be our W, which is a number we both know is random, but that none of us can prove to outside parties that it's not random. We're not sending W over the line because we both know what it is."
Charlie: "Here's the message M I want to prove to you is sent by Alice. I'm sending you (SHA1(M) xor W) signed by Alice's private RSA key."
From Bob's prespective, everything's legit. He knows that no one could know what the number W was before he revealed the private key Y. Thanks to RSA, he knows that Alice made the message (SHA1(M) xor W), meaning that Alice intended to send the message M.
But if Bob were to show these messages to Dan, he couldn't be sure that Alice indeed sent M; perhaps Bob is trying to cheat him? Perhaps Bob composed message M himself, with no connection to Alice, and built the Charlie persona himself just to make it look like Alice sent the message? Let's see how Bob could have done that.
Maybe Bob obtained, in some way, an arbitrary string F signed by Alice's keypair from a past communication with her. He calculated (SHA1(M) xor F) and called it W, so now he can say he has Alice's digital signature on (SHA1(M) xor W), which is just (SHA1(M) xor (SHA1(M) xor F)) which is just F. He created the random keypair X and Y, and calculated Z, which is (Y xor W), which makes W be (Z xor Y). Then he created the disposable Charlie persona and constructed the entire fictional thread of conversation between them which includes all these numbers.
Bob knows he didn't do all of that, but Dan can't be sure, and thus our objective is reached.
Are there any problems in this protocol that I didn't think of?