Questions tagged [blind-signature]

In a blind signature scheme, the signer does not know what he is signing. This is an important building block of anonymous voting or digital cash schemes, because it allows an authority to control the creating of signed messages, but doesn't allow it to track their use.

27 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
13 votes
0 answers
690 views

Potential Flaws With Lattice Based Cryptography?

From researching post-quantum cryptographic schemes it seems hash-based and lattice-based algorithms are the most promising (MQ-based seem to be covered by patents and have more potential unknowns ...
CoryG's user avatar
  • 559
6 votes
0 answers
129 views

Understanding anonymous credentials. Does someone understand how it works?

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it. I ...
Bean Guy's user avatar
  • 732
4 votes
0 answers
146 views

The security of blind RSA signatures with modular exponentiation as padding

It is known that (blind) RSA signature implementations should apply some sort of padding to messages before signing or blinding them. Does blind RSA signature with modular exponentiation as a padding ...
István András Seres's user avatar
4 votes
0 answers
768 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
Joshua Zeidner's user avatar
3 votes
0 answers
69 views

Security of Blind Signature Schemes in the Concurrent Setting

I am quite confused about the security definition of blind signature schemes in the concurrent setting. I have found a paper as follows showing that most of the previous blind signature schemes cannot ...
Chris Huang's user avatar
2 votes
0 answers
65 views

Need help in proving of disproving security of generic partially-blind-signature construction

I have a project where I need to use a linear partially blind signature scheme. I looked at Abe-Okamoto, but I can't easily make it linear. So I looked at Okamoto-Schnorr blind signatures (here and ...
Alex Pinto's user avatar
2 votes
0 answers
240 views

ZK Proof that a blinded message (for a blind signature) contains a certain value

I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation. In particular, I'm using this formulation from this link: User ...
Alex Pinto's user avatar
2 votes
0 answers
314 views

Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
Andrew Poelstra's user avatar
1 vote
0 answers
71 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
1 vote
0 answers
40 views

Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
New Alexandria's user avatar
1 vote
0 answers
26 views

Single Term Off-Line Coins : Corrections on the final signatures

I am making an implementation of Niels Ferguson's paper: Single Term Off-Line Coins in Python. In the Coin withdrawal protocol, in the last steps, Alice checks that the signatures she received are ...
leon._'s user avatar
  • 33
1 vote
0 answers
87 views

ABE and OKAMOTO definition of partially blind signature scheme

I'm trying to understand the definition of a partially blind scheme that is described with Game A presented in Abe and Okamoto paper In line 5 is $msg_0$ correct or should it be replaced by $(info_0,...
Panos's user avatar
  • 41
1 vote
0 answers
134 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
DodoDude700's user avatar
1 vote
0 answers
69 views

Security of anonymous group credential issued over multiple user secret keys plus a common/public system message

In a group signature scheme based on Pointcheval-Sanders (PS) single-message signature, the anonymous credential $(\sigma_1,\sigma_2)$ issued by the group manager (GM) with secret key $sk = (x,y) \in \...
Star Seller's user avatar
1 vote
0 answers
52 views

Do practical blind signature schemes make compromises?

I am fascinated by the idea of blind signatures and their applications introduced by David Chaum for electronic cash and voting and his provided analogy with carbon copy is quite compelling. However ...
Jānis Erdmanis's user avatar
1 vote
0 answers
248 views

Proof ownership of private key for blinded public key

so i want to prove to a server that i have the private key to a public key for which i want to retrieve the server's signature. But the server is not allowed to learn either public nor private key. ...
flying_duck's user avatar
1 vote
0 answers
82 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
Alex Pinto's user avatar
1 vote
0 answers
59 views

Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version?

Q: Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version? I am searching for an algorithm where you can see what happens if you ...
sycx2's user avatar
  • 11
1 vote
0 answers
195 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
jhnn's user avatar
  • 123
1 vote
0 answers
97 views

Digital cash and blind signiture: coherence between signature and serial number

My question is about the basics of the topic "creating digital cash". At the very beginning of that topic the amount of the banknote and a serial number are the requirements for generating a ...
StellaMaris's user avatar
1 vote
0 answers
196 views

What are the best practice, and standard tools for blinding algorithms?

I'm developing an app that uses blind signatures. I'm having a hard time finding tools, and best practices for blinding. There is no PKCS. And everywhere I go, I find caveats of different blind ...
cowlicks's user avatar
  • 151
1 vote
0 answers
139 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
driver4567's user avatar
1 vote
0 answers
156 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
thejh's user avatar
  • 111
1 vote
0 answers
255 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
absinthe_minded's user avatar
0 votes
0 answers
167 views

How to prove possession of a CL signature in zero-knowledge?

Assume that we have the following signature scheme CL Signature: Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$. Uniformly and ...
Bean Guy's user avatar
  • 732
0 votes
0 answers
216 views

How does RSA blind signature calculation works?

I am having a struggle calculating (ii) and (iii), Can anybody help me with the calculation? RSA blind signature algorithm: Given two prime numbers: $p=11$ and $q=3$ The message to be signed is: $M=6$ ...
Navid Niknezhad's user avatar
0 votes
0 answers
1k views

Python implementation of a blind signature scheme which doesn't involve RSA

RSA seems a bit creepy after the Snowden revelations and i'm looking for a simple python based blind signature library to fiddle around with. So far i've been unable to find anything. What am i ...
user37203's user avatar
  • 161