# Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following

This attack works because in this blind signature scheme the signer signs the message directly. By contrast, in an unblinded signature scheme the signer would typically use a padding scheme (e.g. by instead signing the result of a cryptographic hash function applied to the message, instead of signing the message itself), however since the signer does not know the actual message, any padding scheme would produce an incorrect value when unblinded.

Could someone please explain the meaning of the part I emphasized?

-
Padding adds a redundancy of a particular form. A random value almost certainly doesn't have that form and is rejected. –  CodesInChaos Jan 3 '14 at 17:07
@CodesInChaos I have a feeling your explanation is on similar level of abstraction as the sentence I'm having problem with. –  Piotr Dobrogost Jan 3 '14 at 20:09

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).
Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.
Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).