# Blind Signatures

The verification algorithm given in blind signature. Should it work for both i)Original message and the signature on it ii)Blinded message and the signature on it.

If yes, then how can we verify if the verification algorithm takes in a parameter which is computed during unblinding stage??

-

For a blind signature scheme you require the blindness and the unforgeability properties to hold to call it secure. For your question the latter is of interest.

Unforgeability here essentially says that if an adversary queries signatures for $n$ messages $m_1,\ldots,m_n$, then the adversary must not be able to efficiently compute another valid signature for $m^*$ such that $m^*\neq m_i$ for $1\leq i\leq n$ (essentially a one-more forgery).

If your second point would be true, then the adversary would query for some message $m$ and the forgery would be the blinded message and would be trivially accepted, since it is accepted by the verification algorithm.

Consequently, you do not want to have ii) in the standard definition of a blind signature scheme.

The question is: why would you require ii) to hold?

-
To ensure that the signer is not any adversary, and has produced the sign using the actual signing algorithm. –  HareshKannan Oct 10 at 7:16
I hope I got your issue: This is what you typically require by the correctness (completness) of the scheme. This basically means that for every keypair and every message $m$ and the resulting signature $\sigma$ which the user receives after interaction, one requires that the verification accepts $m$ and $\sigma$ with the corresponding public key of the issuer. Actually you can never prevent in practice that the signer replaces your sent "blinded message" with something else and signs this one. But then you will not be able to "unblind" (yielding no valid signature). –  DrLecter Oct 10 at 7:54
Refering to the last issue again. Its a problem of the signer if the signer does such kinds of replacements or tricks. The user who receives the signature can verify if the signature is correct anyways. –  DrLecter Oct 10 at 7:56
And one more question. I have a verification algorithm that takes in parameter which are computed after unblinding. And it is quite impossible for me to verify the blinded message and it's signature. Do you think there is any alternative solution to this problem?? –  HareshKannan Oct 10 at 8:22
Are you designing a blind signature scheme? In DL based blind signatures it is quite common that the user computes something after having received the signature parameters from the signer: you may take a look here –  DrLecter Oct 10 at 9:17