Blind Signatures

The verification algorithm given in blind signature. Should it work for both

1. Original message and the signature on it
2. Blinded message and the signature on it.

If yes, then how can we verify if the verification algorithm takes in a parameter which is computed during unblinding stage??

For a blind signature scheme you require the blindness and the unforgeability properties to hold to call it secure. For your question the latter is of interest.

Unforgeability here essentially says that if an adversary queries signatures for $n$ messages $m_1,\ldots,m_n$, then the adversary must not be able to efficiently compute another valid signature for $m^*$ such that $m^*\neq m_i$ for $1\leq i\leq n$ (essentially a one-more forgery).

If your second point would be true, then the adversary would query for some message $m$ and the forgery would be the blinded message and would be trivially accepted, since it is accepted by the verification algorithm.

Consequently, you do not want to have ii) in the standard definition of a blind signature scheme.

The question is: why would you require ii) to hold?

• To ensure that the signer is not any adversary, and has produced the sign using the actual signing algorithm. Oct 10 '13 at 7:16
• I hope I got your issue: This is what you typically require by the correctness (completness) of the scheme. This basically means that for every keypair and every message $m$ and the resulting signature $\sigma$ which the user receives after interaction, one requires that the verification accepts $m$ and $\sigma$ with the corresponding public key of the issuer. Actually you can never prevent in practice that the signer replaces your sent "blinded message" with something else and signs this one. But then you will not be able to "unblind" (yielding no valid signature). Oct 10 '13 at 7:54
• Refering to the last issue again. Its a problem of the signer if the signer does such kinds of replacements or tricks. The user who receives the signature can verify if the signature is correct anyways. Oct 10 '13 at 7:56
• Yes, am designing a blind signature based on DL. I have parameters which are computed later. So verification of blind signature was not possible before unblinding. Oct 10 '13 at 9:21
• Ok. But it is ok that verification is not possible before "unblinding" (or finishing the computation of the parameters). Otherwise the blinded signature would be a valid signature for some other message and as I mentioned above, this would yield an insecure construction w.r.t the standard definition. Oct 10 '13 at 9:23

Short answer is, verification algorithm would take no parameters, other than message and signature. Generally, one would start from definition of specific signature scheme describing exactly what is called "unblinding".

For blind RSA, "blinding factor" $b$ is chosen at random before sending anything to the signer (at blinding stage). Let $m$ be a message, $(e, d)$ and $N$ be (public, private) RSA keys and modulus. Blinded message $\bar m = m b^e \pmod{N}$ is sent to the signer. Blinded signature is $\bar s = \bar m^d \pmod{N}$. Unlinded signature $s = \bar s b^{-1} \pmod{N}$ is calculated with blinding factor $b$.

For a DL-based blind signature scheme, one would refer to blind Schnorr scheme or U-Prove, depending on properties wanted.

For signature schemes above, verification algorithm holds for both blinded and unblinded message/signature pairs, and do not take blinding parameters at all.