Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme

The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it.

The process they describe is pretty standard:

  • Requester blinds a message using his key and sends blinded message to signer
  • The signer signs the message resulting with pair $(r,s)$ which is sent to requester
  • BUT then the requester unblinds ONLY $s$ component and $r$ component is published unchanged

It seems logical that after publishing $r$ the way it came from signer would allow
the signer to track transactions by keeping a database of all issued $(r,s)$ tokens?

Or am I missing something?

share|improve this question
Well, one immediate thing is that this is not an ECDSA blind signature scheme since $(r,s)$ is a pair of EC points while in ECDSA they should be a pair of numbers. You're right that this isn't blind, but it's not even a signature scheme: given a "blind signature" $(r,s)$ for message $m$, before unblinding the recipient can simply multiply both $r$ and $s$ by $m'm^{-1}$ to get a "blind signature" for any message $m'$. I'd throw this paper away and forget about it. – Andrew Poelstra May 5 '14 at 22:50
You can also easily totally break the "signature scheme" when looking at the verification relation, without any prior signature, and for arbitrary messages (apart from the fact that their EC arithmetic is mess). Do not print that one...its not worth the paper you print it on. – DrLecter May 6 '14 at 5:25
@AndrewPoelstra These comments are all destroying the paper (and, it seems, the entire team that wrote and verified it), but is it possible to create an answer for Lu4? It seems to me that a simple "Yes, it isn't blind, you are correct" would suffice in this case, closing the question. I'm currently not in the position to verify the statement. – Maarten Bodewes May 6 '14 at 9:01
I'm so angry, I have lost a day working that paper-out, elliptic curves is a new subject for me. Anyway I was looking for a partially blind signature algorithm and haven't found one. But based on this work… I was able to create my own partially blind signature (I think) :) here's the link to the post… – Lu4 May 7 '14 at 1:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.