Blind signatures security

Question

I was reading up on blind signatures. I came across the following paragraph in this paper.

Previous methods of proofs used to establish security arguments for signature schemes no longer work since, during the collusion between the signer, the attacker and the random oracle, we lose control over the value that the signer receives: it no longer comes from the random oracle, but from the attacker. As a consequence, the signer cannot be simulated without the secret key, otherwise the signature scheme would be universally forgeable

The authors go on to use the concept of witness indistinguishibilty to solve the above problem.

I am not able to understand what the author means by :

the signer cannot be simulated without the secret key.

Can anyone explain why this is the case?

Answer 1

Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs involve the simulator responding to random oracle queries in a way that will necessarily make their signatures validate, which they can do because they have control over the random oracle's input and can program it to have the right value specifically on the query needed for a particular signature.

If they program the wrong value, the simulation will produce an invalid signature (proof fails), and if they program the right value on the wrong query, they're also out of luck since the right query needs to have an independently random output from the attacker's view, so the simulator is forced to use the wrong value on the right query.

However in a blind signature the simulator doesn't get to query the random oracle for signatures, it has to sign the attacker's challenge. In effect, the attacker gets to behave as the random oracle. For common signatures which are also proof-of-knowledge of the secret key (at least when the public key is fixed in advance), this necessarily forces the simulator to have knowledge of the secret key.