I want to know if we use function H as random oracle in RSA Blind Signature and assume that RSA Assumption is correct, is it true that the RSA blind signature schema is secure?(i.e. There isn't any adversary who can create a valid signature on a message that he doesn't queried to signer oracle). Intuitively, I think this is true, but I can't prove it formally. Does anyone have an idea?

  • $\begingroup$ You might want to add a little more detail in the title. $\endgroup$
    – Daffy
    Jun 25, 2017 at 21:23
  • $\begingroup$ I am not aware of a technique to prove it under the RSA assumption. But you can prove it in the random oracle model under the stronger one-more RSA assumption: eprint.iacr.org/2001/002 $\endgroup$
    – DrLecter
    Jun 26, 2017 at 2:49

1 Answer 1


Blind signature works as follows:

(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $

(2) the signer will blindly sign the value by raising it to its private key $d$, as $ \sigma'^d = b \cdot M^d $

(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\sigma = M^d$.

To forge a valid signature without needing the signer, you can start by an inverse process i.e. create a garbage message and signature pair $<\sigma=M,message=M^e>$.

This will work because when the verifier wants to check the validity of the message, signature pair it will raise the signature $\sigma$ to the public exponent $e$ and it will match. The down point for this is that the adversary will have rubbish message.

  • $\begingroup$ It looks you consider that H(m) = m, but I said H is random oracle. $\endgroup$
    – ThisIsMe
    Jun 26, 2017 at 5:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.