Tag Info

6

As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works. Remarks from the previous ...

5

Designing such signature schemes from scratch without having strong experience is very likely to fail and very dangerous (see the tons of bad papers out there being accepted to "dubious" conferences and journals). Your proposed scheme Your verification relation is to check if: $sP - Q + R \stackrel{?}{=} zP + mP$ where $Q$ is the public key of the signer ...

4

I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out: Blind signatures for untraceable payments, Chaum Provably secure blind signatures schemes, Pointcheval By the way if you look at the introduction of the second title it seems what your looking for. ...

4

As @CodesInChaos explains: It might refer to blind signatures. It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it. Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just ...

4

The answer is correct, you don't need to unpad the message. When/if you verify the signature, simply check that $(\text{signature})^e == \text{pad}(\text{message})$ Regarding the padding scheme, you can just use a full domain hash. Here's how you implement a full domain hash:  \mathrm{cycles} = \frac{\text{(RSA key length)}}{\text{(SHA digest length)} \...

3

You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$. On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...

3

I'm not really familiar with blind signature schemes, so please take the following with a grain of salt, but what you describe looks like a really funny way to apply padding. Normally, one would pad the message (using a suitable padding scheme like RSA-PSS) before the first RSA operation, i.e. $\text{padded message = pad(message)}$ $\text{blinded message =... 3 If you are not limited to HMAC, blind signatures would meet your requirements. In RSA, you can do blind signatures as follows: Let$M$be the message to be signed (probably the hash of a message) and let$e,N$be A's public key,$d$is A's private key. B computes$M' = M\cdot r^e \bmod{N}$and sends$M'$to A. A computes$S' = M'^d\bmod{N}$... 3 Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing friendly elliptic curve groups. This blind signature scheme can be based on the compact BLS-signature scheme (which is based on gap-DH groups, i.e., groups in which ... 2 You are wrong. The purpose is to prevent linking the signing operation with the verification operation. For instance, suppose that I have to identify myself when I ask B to sign the thing (maybe B charges me to create a signature; for instance, when blind signatures are used for e-cash, B is the bank, and B charges money to sign anything, since validly-... 2 No, that is not correct. You appear to have a misconception about how RSA signatures work. Here is how an RSA signature is generated: You take your message$M$You apply a padding function to create a value$m = pad(M)$You then use the RSA private key to compute$m^d \bmod N$Now, this last step isn't always done in the straight-forward manner. With ... 2 In the blind RSA signature scheme the blinding of a message$m$(to be blindly signed) is multiplicative with value$r^e$, where you ensure that$r$is invertible modulo$N$. So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with$r^{-1}$, yielding$s\equiv m^d \pmod N$which is a valid (textbook) RSA ... 2 So let's first recall how blinded RSA works: Select primes$p=11$and$q=19$, calculate the modulus$n=pq=209$, choose a public exponent$e=7$. Now calculate the signature exponent$d\equiv e^{-1} \pmod{(p-1)(q-1)}$($d=103, (p-1)(q-1)=180$). Now let's go to the message-dependant processing: A message$M$is represented as the integer$m=16$which is ... 2 It may be an interesting avenue to explore. I've read the highlight reel of the digital cash literature but I do not know it well enough to know how well these issues have been addressed. A few things to consider for #2: In a quick read of Lucre, it seems that the payee does no verification before passing the coin onto the mint. It seems, if the mint has ... 2 The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures: Lets say we want to blindly sign distinct messages$m_1$and$m_2$with distinct randomness$r_1$and$r_2$. Now during the blind signing you produce the transcripts (I omit$\mod N$):$m_1'=...

1

Well, I think it is quite hard to give a really objective and complete answer to this question. Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite ...

1

I could solve my question using the fundamental work of Eric Verheul: Self-Blindable Credential Certificates from the Weil Pairing. What I didn't know was the basic principle of self-blinding. In its simplest form, a peer (sk: $x\in Z$, pk: $X=g_1^x\in G_1$) communicates with an authority (sk: $a\in Z$, pk: $A=g_2^a\in G_2$) to get a certificate for his pk. ...

1

Blind signatures can be constructed from a ordinary "textbook" RSA signature by seperating the blinding/unblinding operations from the signature operation. The problem is that we do not use textbook RSA signatures in practice. Rather RSA signatures are padded, which increases the security of the signature but also destroys the ability for blinding. Some ...

Only top voted, non community-wiki answers of a minimum length are eligible