Which blind signature schemes exist, and how do they compare?

Question

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there should be a elliptic curve scheme, which might have better performance than the other schemes.

In particular I'm interested in:

• Performance - how expensive is it to create/validate the signature? I mainly care about the cost for the authority(does signing and verification), and less about the performance of the client (does blinding and verification)
• Patents - Is the scheme patented? Have the patents expired?
• Simplicity - Is it easy to understand? Is it easy to make subtle mistakes which compromise anonymity or security?

My current evaluation of RSA and Lucre:

Blinded RSA

• Requires an RSA private key operation for signing. This is relatively expensive, especially if keys larger keys(say 2048 bit) are used.
• Patented by Chaum, but the patents should have expired by now
• Quite simple, even I understand it

Lucre

• Not sure about the performance, but I don't expect much better performance than with RSA.
• Paper claims it is patent free, at least in some variations
• There are some subtle points. If used incorrectly the signer might be able to abuse being able to choose k in a way that compromises anonymity. I don't really understand it (yet).

Reading the paper a few more times, it seems like most variants of lucre aren't "real" signatures that can be verified by everyone. But rather you need to perform an interactive probabilistic proof. Some variants doesn't suffer from this problem, but they might have other problems.

My subjective impression is that I don't like lucre. It seems like its only raison d'être is that is avoids Chaum's patents. But if those are expired, this shouldn't be an issue anymore.

Answer 1

There are elliptic curve blind signature schemes out there. I'm not being cute but just google "blind signature elliptic curve" and the 4th hit should be good, others will show up there also.

Answer 2

I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out:

• Blind signatures for untraceable payments, Chaum

• Provably secure blind signatures schemes, Pointcheval

By the way if you look at the introduction of the second title it seems what your looking for.

---

A specific link on Electronic Cash from RSA Laboratories:

• What is Electronic Money

---

By studying blind signatures I've read about a scheme based on ElGamal Signature Scheme, I'll provide the information I was able to glimpse.

You can find more details at the following links:

• IEEE, A blind signature scheme based on ElGamal signature

• Citeseerx, Generalized blind signature schemes

Blinded ElGamal:

• Performances:

Owner Alice needs to compute two online exponentiations modulo $p$ with a |$q$| bit exponent and one offline inverse modulo $q$.

Notary Nancy needs to compute just one online exponentiations modulo $p$ with a |$q$| bit exponent.

Verifier Victor needs to compute two exponentiations instead of the three ones required for standard ElGamal scheme.

Note: you can find further references for even more efficient variants in the links I provided.

• Patents:

I have no clue!Sorry about that...

• Simplicity:

I got it all clear, if reading the papers you have any doubts post them and we can check together!