Skip to main content
Cryptography

Return to Answer

added 13 characters in body
Source Link
DrLecter
DrLecter
  • 12.6k
  • 3
  • 44
  • 61

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.

Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.

Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.

Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).

Source Link
DrLecter
DrLecter
  • 12.6k
  • 3
  • 44
  • 61

In the blind RSA signature scheme the blinding of a message $m$ (to be blindly signed) is multiplicative with value $r^e$, where you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv m^d \pmod N$ which is a valid (textbook) RSA signature for $m$.

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA signatures, which however needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv mr^e \pmod N$, then padding by the signer means that the signer changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before signing. Padding methods for RSA signatures hash the original message (possibly with some parameters), padd the hash value to some certain format and the result is then interpreted as an element in $Z_N$, which is then exponentiated with the private signing exponent $d$.

Observe that in doing so the signer padds an already blinded message and denote this padded blinded message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, will yield some element from $Z_N$ which is clearly not a valid signature for the message $m$ the sender wants to be signed (for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).