# Is this schema secure?

I want to know if we use function H as random oracle in RSA Blind Signature and assume that RSA Assumption is correct, is it true that the RSA blind signature schema is secure?(i.e. There isn't any adversary who can create a valid signature on a message that he doesn't queried to signer oracle). Intuitively, I think this is true, but I can't prove it formally. Does anyone have an idea?

• You might want to add a little more detail in the title. – Daffy Jun 25 '17 at 21:23
• I am not aware of a technique to prove it under the RSA assumption. But you can prove it in the random oracle model under the stronger one-more RSA assumption: eprint.iacr.org/2001/002 – DrLecter Jun 26 '17 at 2:49

Blind signature works as follows:

(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $b^e \cdot M$

(2) the signer will blindly sign the value by raising it to its private key $d$, as $\sigma'^d = b \cdot M^d$

(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\sigma = M^d$.

To forge a valid signature without needing the signer, you can start by an inverse process i.e. create a garbage message and signature pair $<\sigma=M,message=M^e>$.

This will work because when the verifier wants to check the validity of the message, signature pair it will raise the signature $\sigma$ to the public exponent $e$ and it will match. The down point for this is that the adversary will have rubbish message.

• It looks you consider that H(m) = m, but I said H is random oracle. – ThisIsMe Jun 26 '17 at 5:41