Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The verification algorithm given in blind signature. Should it work for both

  1. Original message and the signature on it
  2. Blinded message and the signature on it.

If yes, then how can we verify if the verification algorithm takes in a parameter which is computed during unblinding stage??

share|improve this question

1 Answer 1

up vote 0 down vote accepted

For a blind signature scheme you require the blindness and the unforgeability properties to hold to call it secure. For your question the latter is of interest.

Unforgeability here essentially says that if an adversary queries signatures for $n$ messages $m_1,\ldots,m_n$, then the adversary must not be able to efficiently compute another valid signature for $m^*$ such that $m^*\neq m_i$ for $1\leq i\leq n$ (essentially a one-more forgery).

If your second point would be true, then the adversary would query for some message $m$ and the forgery would be the blinded message and would be trivially accepted, since it is accepted by the verification algorithm.

Consequently, you do not want to have ii) in the standard definition of a blind signature scheme.

The question is: why would you require ii) to hold?

share|improve this answer
    
To ensure that the signer is not any adversary, and has produced the sign using the actual signing algorithm. –  HareshKannan Oct 10 '13 at 7:16
    
I hope I got your issue: This is what you typically require by the correctness (completness) of the scheme. This basically means that for every keypair and every message $m$ and the resulting signature $\sigma$ which the user receives after interaction, one requires that the verification accepts $m$ and $\sigma$ with the corresponding public key of the issuer. Actually you can never prevent in practice that the signer replaces your sent "blinded message" with something else and signs this one. But then you will not be able to "unblind" (yielding no valid signature). –  DrLecter Oct 10 '13 at 7:54
    
Refering to the last issue again. Its a problem of the signer if the signer does such kinds of replacements or tricks. The user who receives the signature can verify if the signature is correct anyways. –  DrLecter Oct 10 '13 at 7:56
1  
Yes, am designing a blind signature based on DL. I have parameters which are computed later. So verification of blind signature was not possible before unblinding. –  HareshKannan Oct 10 '13 at 9:21
1  
Ok. But it is ok that verification is not possible before "unblinding" (or finishing the computation of the parameters). Otherwise the blinded signature would be a valid signature for some other message and as I mentioned above, this would yield an insecure construction w.r.t the standard definition. –  DrLecter Oct 10 '13 at 9:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.