Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to DSA? DSA appears to be about 6x more performant and is not prone to attacks like timing attacks. The security of RSA scheme isn't even proven, right?
Thanks
Well, I think it is quite hard to give a really objective and complete answer to this question.
Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite recently). RSA blind signatures can be proven secure in the random oracle model under an interactive assumption (the one-more RSA inversion assumption), see here. Some people may say that proving security under some interactive assumption is not really nice, but we do not have any better arguments for this scheme. A nice thing from a theoretical point of view, however, is that RSA blind signatures are round optimal, i.e., two move (one message to the signer and one back), and thus automatically concurrently secure, i.e., one does not need to care about attacks due to interleaving different signing sessions.
Schnorr type blind signatures (such as blind DSA signatures) are conceptually not that simple (although also not really complicated) and always at least three move (and thus not round optimal). From a provable security point of view they can be proven secure in the random oracle model, but as far as I know all reductions require the forking lemma and are thus not really tight. You have to decide on your own if you would rather live with interactive assumptions or loose reductions to the discrete log assumption.
If you are looking for practical blind signatures in the discrete log setting, you may also look at BLS blind signatures, which are round optimal and can be proven secure in the random oracle model under an interactive assumption (quite similar to that of the RSA blind signature scheme). However, they require gap Diffie Hellman groups, i.e., groups where the DDH is easy, and thus requires pairings.
From an implementation point of view I think it is hard to give a general answer as it really depends over which types of groups you are going to instantiate blind signatures in the discrete log based setting.
