Tag Info

Hot answers tagged

5

As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works. Remarks from the previous ...


4

I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out: Blind signatures for untraceable payments, Chaum Provably secure blind signatures schemes, Pointcheval By the way if you look at the introduction of the second title it seems what your looking for. ...


4

As @CodesInChaos explains: It might refer to blind signatures. It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it. Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just ...


3

The answer is correct, you don't need to unpad the message. When/if you verify the signature, simply check that $(\text{signature})^e == \text{pad}(\text{message})$ Regarding the padding scheme, you can just use a full domain hash. Here's how you implement a full domain hash: $$ \mathrm{cycles} = \frac{\text{(RSA key length)}}{\text{(SHA digest length)} ...


3

If you are not limited to HMAC, blind signatures would meet your requirements. In RSA, you can do blind signatures as follows: Let $M$ be the message to be signed (probably the hash of a message) and let $e,N$ be A's public key, $d$ is A's private key. B computes $M' = M\cdot r^e \bmod{N}$ and sends $M'$ to A. A computes $S' = ...


2

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$. So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA ...


2

Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing friendly elliptic curve groups. This blind signature scheme can be based on the compact BLS-signature scheme (which is based on gap-DH groups, i.e., groups in which ...


2

You are wrong. The purpose is to prevent linking the signing operation with the verification operation. For instance, suppose that I have to identify myself when I ask B to sign the thing (maybe B charges me to create a signature; for instance, when blind signatures are used for e-cash, B is the bank, and B charges money to sign anything, since ...


2

No, that is not correct. You appear to have a misconception about how RSA signatures work. Here is how an RSA signature is generated: You take your message $M$ You apply a padding function to create a value $m = pad(M)$ You then use the RSA private key to compute $m^d \bmod N$ Now, this last step isn't always done in the straight-forward manner. With ...


1

I'm not really familiar with blind signature schemes, so please take the following with a grain of salt, but what you describe looks like a really funny way to apply padding. Normally, one would pad the message (using a suitable padding scheme like RSA-PSS) before the first RSA operation, i.e. $\text{padded message = pad(message)}$ $\text{blinded message ...


1

Blind signatures can be constructed from a ordinary "textbook" RSA signature by seperating the blinding/unblinding operations from the signature operation. The problem is that we do not use textbook RSA signatures in practice. Rather RSA signatures are padded, which increases the security of the signature but also destroys the ability for blinding. Some ...



Only top voted, non community-wiki answers of a minimum length are eligible