Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme
The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it.
The process they describe is pretty standard:
- Requester blinds a message using his key and sends blinded message to signer
- The signer signs the message resulting with pair $(r,s)$ which is sent to requester
- BUT then the requester unblinds ONLY $s$ component and $r$ component is published unchanged
It seems logical that after publishing $r$ the way it came from signer would allow
the signer to track transactions by keeping a database of all issued $(r,s)$ tokens?
Or am I missing something?