Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following

This attack works because in this blind signature scheme the signer signs the message directly. By contrast, in an unblinded signature scheme the signer would typically use a padding scheme (e.g. by instead signing the result of a cryptographic hash function applied to the message, instead of signing the message itself), however since the signer does not know the actual message, any padding scheme would produce an incorrect value when unblinded.

Could someone please explain the meaning of the part I emphasized?

share|improve this question
Padding adds a redundancy of a particular form. A random value almost certainly doesn't have that form and is rejected. – CodesInChaos Jan 3 '14 at 17:07
@CodesInChaos I have a feeling your explanation is on similar level of abstraction as the sentence I'm having problem with. – Piotr Dobrogost Jan 3 '14 at 20:09
up vote 2 down vote accepted

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.

Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.