3
$\begingroup$

Recently, I started looking up for details about implementing a blind signature on ed25519 cryptographic. I saw this article https://stan.bar/blindsig/ by Stanislaw Baranski about it. In the first point, it says that Bob generates random number (nonce) $k$ in range $(1, q-1)$, computes $r=k \times G (\mod p)$ $r=k×G(\mod p)$ and sends $r$ to Alice.

Now, how safe it is to make $r$ public and to share the same r across different signer? or should I make differents $r$ for each signer and still publicly publish all $r$?

Improve this question
$\endgroup$
18
  • 1
    $\begingroup$ Note that the article has errors. It says that "We use uppercase letters for points on a curve", yet uses lowercase $r$ instead of $R$ in $r=kG$. It uses the operator symbol ✕ both for scalar multiplication and for point addition, which is confusing. It also contains references to "mod p", which is a remnant of non-EC schemes which should not appear in EC point math. $\endgroup$
    – knaccc
    Nov 14, 2022 at 14:02
  • $\begingroup$ You are right, after a better look i noticed such errors too. Do you know any better reference for blind signature on ed25519? $\endgroup$
    – user10002393
    Nov 14, 2022 at 14:03
  • $\begingroup$ Is it essential for your use case that the signer is unable to recognize the signature later? It's easy to ask someone to sign something such that the signer isn't aware of the message. The more difficult part is making it impossible for the signer to recognize their signature later. What is your use case? $\endgroup$
    – knaccc
    Nov 14, 2022 at 14:08
  • 1
    $\begingroup$ @StanislawBaranski it looks like you've addressed the issues. Btw, mod p still applies for scalar-only arithmetic - I just meant it should not appear on a line which has point operations, since you don't mod p a point. One other thing - when dealing with point coordinates, the x and y are mod q, where q is the dimension of the finite field, i.e. 2^255-19. The other number, p, is the group order, and is a different number that scalar-only operations are modded by. Random scalars are less than p, so that part of your article is correct as long as you don't say earlier that p = 2^255-19 $\endgroup$
    – knaccc
    Nov 19, 2022 at 23:15
  • 1
    $\begingroup$ @StanislawBaranski one last thing, if you're calling the group order L, then the scalars should be integers less than L. Your article currently still says less than p $\endgroup$
    – knaccc
    Nov 20, 2022 at 2:59

1 Answer 1

Reset to default
3
$\begingroup$

The article makes reference to a point $r$, which is the blind signer's public commitment to their secret nonce $k$.

If $r$ is re-used, this implies the same secret nonce $k$ is re-used. You should therefore always have a different $k$ for every single signature produced, which implies a different $r$ commitment value each time.

There is no loss of signature blindness if a blind signer's $r$ values are published publicly.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.