Reading this paper, I have some questions about blind signatures
What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly.
In blind signatures (like RSA), if there is a valid origin signatures pair (m,s), then blind message and corresponding signatures pair (m',s') also valid, but it is existential forgery for adversary (even though m' maybe meaningless or random in piratical), so why it can be a secure signature?
What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly.
Unlinkability basically means that when the unblinded signature is revealed the signer cannot link the unblinded message to one of the blinded messages that it has signed.
In blind signatures (like RSA), if there is a valid origin signatures pair (m,s), then blind message and corresponding signatures pair (m',s') also valid, but it is existential forgery for adversary (even though m' maybe meaningless or random in piratical), so why it can be a secure signature?
To sign a message $m$ with the blind RSA signature, only $(m,s)$ is valid. The blind signature $s'$ is only "valid" for a blinded message hash rather than any message $m'$ because the message should be hashed before getting signed.
More precisely, to sign a message $m$, the user needs to do the following: compute the message hash $H(m)$, pick a random $r$ and compute $r^e$ (where $e$ is the public verification key) to blind the hash, send $r^eH(m)$ to the signer, get a blind signature $\sigma'=rH(m)^d$ (where $d$ is the secret signing key), and unblind it to $\sigma=r^{-1}\sigma'=H(m)^d$. Then, $(m,\sigma)$ is defined as valid if and only if $H(m)=\sigma^e$. So, knowing that $\sigma'$ is "valid" for $r^eH(m)$ does not automatically give you a message $m'$ such that $(m',\sigma')$ is valid.
