# NIZK Proof of Knowledge of a Standard RSA Signature on a message (without signer participation)

I'm looking for a protocol in which a Prover transforms a RSA signature $$\sigma$$ on a message $$m$$ that verifies under a public key $$vk$$ into a NIZK proof of knowledge, $$\pi$$ of that signature. A verifier should then be able to verify that the prover saw a signature for that message and that the signature would have verified under the public key, $$vk$$.

The protocol has three parties: a signer, a prover and a verifier. The signer is the only party that knows the signing key $$sk=d$$. The signer is not aware the protocol is being run and just sends signatures to the prover.

We assume the public key $$vk$$, message $$m$$, and $$\pi$$ are all public, the original signature $$\sigma$$ is known to the prover, but is kept secret from the verifier. The verifier should not be able to learn the signature $$\sigma$$.

The purpose of this protocol is to create a public transparency log of signatures and messages that can be audited without leaking the actual signatures and presenting the risk of an attacker replaying these signatures. Unlike this

Below I provide my draft of such a protocol:

RSA Public key: $$vk=(e, n)$$; RSA Signing key: $$sk=(d)$$; Hash function: $$y \gets h(x)$$

Signer receives message $$m$$ and computes the RSA signature: $$\sigma \gets h(m)^d \mod n$$ and then transmits $$(\sigma,m)$$ to the Prover.

Prover on receiving $$(\sigma,m)$$ computes $$\pi$$ via the following steps:

$$r \xleftarrow{\\\} \mathbb{Z}_n^* \phantom{\mod n}$$ $$w \gets r^{e} \mod n$$ $$\pi \gets \sigma r \mod n \equiv h(m)^d r \mod n$$

and publishes $$(\pi, w, m)$$

Verifier on learning $$(\pi, w, m)$$ verifies these values under the verification key of the signer, $$e$$.