I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there should be a elliptic curve scheme, which might have better performance than the other schemes.
In particular I'm interested in:
- Performance - how expensive is it to create/validate the signature? I mainly care about the cost for the authority(does signing and verification), and less about the performance of the client (does blinding and verification)
- Patents - Is the scheme patented? Have the patents expired?
- Simplicity - Is it easy to understand? Is it easy to make subtle mistakes which compromise anonymity or security?
My current evaluation of RSA and Lucre:
- Requires an RSA private key operation for signing. This is relatively expensive, especially if keys larger keys(say 2048 bit) are used.
- Patented by Chaum, but the patents should have expired by now
- Quite simple, even I understand it
- Not sure about the performance, but I don't expect much better performance than with RSA.
- Paper claims it is patent free, at least in some variations
- There are some subtle points. If used incorrectly the signer might be able to abuse being able to choose
kin a way that compromises anonymity. I don't really understand it (yet).
Reading the paper a few more times, it seems like most variants of lucre aren't "real" signatures that can be verified by everyone. But rather you need to perform an interactive probabilistic proof. Some variants doesn't suffer from this problem, but they might have other problems.
My subjective impression is that I don't like lucre. It seems like its only raison d'être is that is avoids Chaum's patents. But if those are expired, this shouldn't be an issue anymore.