Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its authenticity.
Alice will do Diffie–Hellman between their keys and then MAC the message using the derived secret. To verify, Bob will derive the secret doing his side of Diffie–Hellman and verify the MAC. It is designated verifier since only those who know the DH secret can verify the MAC and also Bob can fake Alice’s “signature” as he knows the MAC key.
Intuitively, to forge Alice’s signature, one needs to either break the MAC to produce it without knowing the secret or break CDH to learn the secret. This is not a proof, of course, since it goes in the opposite direction to the desired reduction and also I don’t think “cannot be verified without knowing the secret key” is among standard guarantees of a MAC?
So, is there something wrong with this scheme? Can its correctness be proven? Has something like this been done?