6
$\begingroup$

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible.

I've been attempting to articulate why and I think that it is because it is not possible to apply a transformation to the message in a way which can be reversed whilst retaining a valid signature. The message and signature cannot be transformed as required because the ephemeral key is not known by the recipient, and if the key were known then the long term signing key could be determined. An ECDSA signature only permits validating that the signature was formed from the message and the private key corresponding to the expected public key.

I would like to confirm whether there are any known ECDSA blind signature schemes? I suppose publication bias might prevent this from appearing in the literature.

More generally are there any known ECDSA variants such as proxy signatures? My research has led me to the conclusion that it's functionality is entirely constrained to yielding a standard signature scheme.

Improve this question
$\endgroup$
4
  • $\begingroup$ You may also want to look at the similar blind Schnorr signatures. $\endgroup$
    – SEJPM
    Commented Sep 26, 2017 at 15:09
  • $\begingroup$ Thank you, I have looked there but I'm ideally attempting to determine whether a 'drop-in' blind signature scheme is available for ECDSA in the same way as with RSA. I also found GDH blind signatures based on BLS. $\endgroup$
    – Chris
    Commented Sep 26, 2017 at 15:32
  • $\begingroup$ I think the reason it's possible with Schnorr signatures is that the [s] value isn't a product of the ephemeral key [k] but rather a sum. $\endgroup$
    – Chris
    Commented Sep 26, 2017 at 15:35
  • $\begingroup$ I believe this is possible with ECDSA, excepted that you'll be constrained when choosing the random blind since you'll need to use a blinded message whose hash is a multiple of the hash of your original message. And then use that same multiple as a blind for $R$ and $S$. $\endgroup$
    – Lery
    Commented Sep 27, 2017 at 5:00

2 Answers 2

Reset to default
6
$\begingroup$

I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).

However I do not believe this is impossible. So let's try to do this for ECDSA:

We have a message $m$ whose hashed value $H(m)$ is converted into an integer $z$ which gets signed into the signature $(r,s)$ by the signer.

Now the verifier will basically rely on $$\begin{aligned} C&=u_1\times G+u_2\times Q\\ &=u_1 \times G +u_2d \times G\\ &=(u_1+u_2 d)\times G \\ &=(zs^{-1}+rds^{-1})\times G \\ &=(z+rds)\color{red}{s^{-1}}\times G \\ &=(z+rd)\color{red}{(z+rd)^{-1}(k^{-1})^{-1}}\times G \\ &=k\times G \end{aligned}$$ And will say that it verifies iff $C_x==r$ And as you can see, if you can change $r,s,z$ then you can force a coefficient in the latest line to cancel "almost out", by taking $bs,abr,abz$ instead and would end up with $$(abz+abrd)\color{red}{b^{-1}(z+rd)^{-1}(k^{-1})^{-1}}\times G \\ = ak\times G $$

Now the difficult part is to find out if it is possible to get $a,b,m'$ such that $H(m')$, once converted into $z'$ is such that $z'=abz$ and such that $(ak\times G)_x \equiv abr\mod n$...

I do not see why this couldn't be possible, being given so much slack on the variables... But since I don't have time right now to actually try it out, I'll try to do it later or another day and will edit this answer accordingly.

Improve this answer
$\endgroup$
10
  • $\begingroup$ Great answer thank you for taking the time, I will also have a look into whether this is possible and mark once determined. $\endgroup$
    – Chris
    Commented Sep 27, 2017 at 13:12
  • $\begingroup$ Notice that if you can provide directly the hashed value like in PureEdDSA then it's easy to do. The hard part is to find a message which gets hashed into $abz$, knowing the relationship between $a$ and $b$. But maybe there is a way to add even more slack in the process by multiplying the $s$ value by a third variable $c$ and so we would just need to select it such that $(ack\times G)=abr$. I'll try to verify this later I've just thought of it. $\endgroup$
    – Lery
    Commented Sep 27, 2017 at 13:48
  • 1
    $\begingroup$ @Chris Alright, my proposal is definitely not possible with ECDSA, since you have to know the $k$ value. This might be possible using deterministic ECDSA, but then it adds one more hard constraint: the modified message must then hash into a suitable $k'$, which is something pretty hard to control... $\endgroup$
    – Lery
    Commented Sep 28, 2017 at 4:59
  • $\begingroup$ Thanks, appreciate the attempt and contribution. That's in-line with my prior findings but with a different method I hadn't considered. $\endgroup$
    – Chris
    Commented Sep 28, 2017 at 7:03
  • 1
    $\begingroup$ Because then the $b$ cancels out with the $b$ contained in the value $(bs)^{-1}$, on line 5 of the verification process in my post (first the red $s^{-1}$ value). $\endgroup$
    – Lery
    Commented Sep 28, 2017 at 10:51
1
$\begingroup$

The below paper gives one;

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.