# Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there should be a elliptic curve scheme, which might have better performance than the other schemes.

In particular I'm interested in:

• Performance - how expensive is it to create/validate the signature? I mainly care about the cost for the authority(does signing and verification), and less about the performance of the client (does blinding and verification)
• Patents - Is the scheme patented? Have the patents expired?
• Simplicity - Is it easy to understand? Is it easy to make subtle mistakes which compromise anonymity or security?

My current evaluation of RSA and Lucre:

## Blinded RSA

• Requires an RSA private key operation for signing. This is relatively expensive, especially if keys larger keys(say 2048 bit) are used.
• Patented by Chaum, but the patents should have expired by now
• Quite simple, even I understand it

## Lucre

• Not sure about the performance, but I don't expect much better performance than with RSA.
• Paper claims it is patent free, at least in some variations
• There are some subtle points. If used incorrectly the signer might be able to abuse being able to choose k in a way that compromises anonymity. I don't really understand it (yet).

Reading the paper a few more times, it seems like most variants of lucre aren't "real" signatures that can be verified by everyone. But rather you need to perform an interactive probabilistic proof. Some variants doesn't suffer from this problem, but they might have other problems.

My subjective impression is that I don't like lucre. It seems like its only raison d'être is that is avoids Chaum's patents. But if those are expired, this shouldn't be an issue anymore.

-

I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out:

By the way if you look at the introduction of the second title it seems what your looking for.

A specific link on Electronic Cash from RSA Laboratories:

By studying blind signatures I've read about a scheme based on ElGamal Signature Scheme, I'll provide the information I was able to glimpse.

You can find more details at the following links:

Blinded ElGamal:

• Performances:

Owner Alice needs to compute two online exponentiations modulo $p$ with a |$q$| bit exponent and one offline inverse modulo $q$.

Notary Nancy needs to compute just one online exponentiations modulo $p$ with a |$q$| bit exponent.

Verifier Victor needs to compute two exponentiations instead of the three ones required for standard ElGamal scheme.

Note: you can find further references for even more efficient variants in the links I provided.

• Patents:

I have no clue!Sorry about that...

• Simplicity:

I got it all clear, if reading the papers you have any doubts post them and we can check together!

-
 First one is the original paper for Blind RSA signatures. I can't look at the second one ATM. I hope my university has a subscription. – CodesInChaos Jun 19 '12 at 20:36 I already know the first and third link. The second one is interesting. – CodesInChaos Jun 20 '12 at 13:49 @CodeInChaos - Happy I could be minimally useful!I'll provide further upgrades of the answer if I get the chance...you too could post the answer if you find out. BTW I've read about a blind scheme based on ElGamal algorithm, and am looking for details. You might check for it as well! – Matteo Jun 20 '12 at 14:08 @CodeInChaos - updated answer!lemme know ;) – Matteo Jun 20 '12 at 16:17

There are elliptic curve blind signature schemes out there. I'm not being cute but just google "blind signature elliptic curve" and the 4th hit should be good, others will show up there also.

-
The problem is finding a scheme that's actually secure/production ready. If you're referring to A Novel Untraceable Blind Signature Based on Elliptic Curve..., it gives me a bad feeling. It seems like there is a way for the requester to obtain two valid signatures in one operation. And it's generally very sloppy. – CodesInChaos Aug 30 '12 at 11:25
@noone, Google's result list heavily depends on location, language, previous searches and other variables. Please post a direct reference instead of pointing to a random entry on Google. – Hendrik Brummermann Sep 3 '12 at 22:00