5
$\begingroup$

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme

The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it.

The process they describe is pretty standard:

  • Requester blinds a message using his key and sends blinded message to signer
  • The signer signs the message resulting with pair $(r,s)$ which is sent to requester
  • BUT then the requester unblinds ONLY $s$ component and $r$ component is published unchanged

It seems logical that after publishing $r$ the way it came from signer would allow
the signer to track transactions by keeping a database of all issued $(r,s)$ tokens?

Or am I missing something?

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ Well, one immediate thing is that this is not an ECDSA blind signature scheme since $(r,s)$ is a pair of EC points while in ECDSA they should be a pair of numbers. You're right that this isn't blind, but it's not even a signature scheme: given a "blind signature" $(r,s)$ for message $m$, before unblinding the recipient can simply multiply both $r$ and $s$ by $m'm^{-1}$ to get a "blind signature" for any message $m'$. I'd throw this paper away and forget about it. $\endgroup$
    – Andrew Poelstra
    Commented May 5, 2014 at 22:50
  • $\begingroup$ You can also easily totally break the "signature scheme" when looking at the verification relation, without any prior signature, and for arbitrary messages (apart from the fact that their EC arithmetic is mess). Do not print that one...its not worth the paper you print it on. $\endgroup$
    – DrLecter
    Commented May 6, 2014 at 5:25
  • 1
    $\begingroup$ @AndrewPoelstra These comments are all destroying the paper (and, it seems, the entire team that wrote and verified it), but is it possible to create an answer for Lu4? It seems to me that a simple "Yes, it isn't blind, you are correct" would suffice in this case, closing the question. I'm currently not in the position to verify the statement. $\endgroup$
    – Maarten Bodewes ♦
    Commented May 6, 2014 at 9:01
  • $\begingroup$ I'm so angry, I have lost a day working that paper-out, elliptic curves is a new subject for me. Anyway I was looking for a partially blind signature algorithm and haven't found one. But based on this work ijns.femto.com.tw/contents/ijns-v14-n6/… I was able to create my own partially blind signature (I think) :) here's the link to the post crypto.stackexchange.com/questions/16044/… $\endgroup$
    – Lu4
    Commented May 7, 2014 at 1:27

1 Answer 1

Reset to default
4
$\begingroup$

This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you fix that by pretending any of it makes sense the whole thing is trivially breakable. Throw it away and forget the whole ordeal—except don't forget that the ‘Journal of Networks’ is a bullshit-publishing paper mill.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.