# Are (EC) DSA blind signatures possible?

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible.

I've been attempting to articulate why and I think that it is because it is not possible to apply a transformation to the message in a way which can be reversed whilst retaining a valid signature. The message and signature cannot be transformed as required because the ephemeral key is not known by the recipient, and if the key were known then the long term signing key could be determined. An ECDSA signature only permits validating that the signature was formed from the message and the private key corresponding to the expected public key.

I would like to confirm whether there are any known ECDSA blind signature schemes? I suppose publication bias might prevent this from appearing in the literature.

More generally are there any known ECDSA variants such as proxy signatures? My research has led me to the conclusion that it's functionality is entirely constrained to yielding a standard signature scheme.

• You may also want to look at the similar blind Schnorr signatures.
– SEJPM
Sep 26 '17 at 15:09
• Thank you, I have looked there but I'm ideally attempting to determine whether a 'drop-in' blind signature scheme is available for ECDSA in the same way as with RSA. I also found GDH blind signatures based on BLS. Sep 26 '17 at 15:32
• I think the reason it's possible with Schnorr signatures is that the [s] value isn't a product of the ephemeral key [k] but rather a sum. Sep 26 '17 at 15:35
• I believe this is possible with ECDSA, excepted that you'll be constrained when choosing the random blind since you'll need to use a blinded message whose hash is a multiple of the hash of your original message. And then use that same multiple as a blind for $R$ and $S$.
– Lery
Sep 27 '17 at 5:00

## 2 Answers

I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).

However I do not believe this is impossible. So let's try to do this for ECDSA:

We have a message $m$ whose hashed value $H(m)$ is converted into an integer $z$ which gets signed into the signature $(r,s)$ by the signer.

Now the verifier will basically rely on \begin{aligned} C&=u_1\times G+u_2\times Q\\ &=u_1 \times G +u_2d \times G\\ &=(u_1+u_2 d)\times G \\ &=(zs^{-1}+rds^{-1})\times G \\ &=(z+rds)\color{red}{s^{-1}}\times G \\ &=(z+rd)\color{red}{(z+rd)^{-1}(k^{-1})^{-1}}\times G \\ &=k\times G \end{aligned} And will say that it verifies iff $C_x==r$ And as you can see, if you can change $r,s,z$ then you can force a coefficient in the latest line to cancel "almost out", by taking $bs,abr,abz$ instead and would end up with $$(abz+abrd)\color{red}{b^{-1}(z+rd)^{-1}(k^{-1})^{-1}}\times G \\ = ak\times G$$

Now the difficult part is to find out if it is possible to get $a,b,m'$ such that $H(m')$, once converted into $z'$ is such that $z'=abz$ and such that $(ak\times G)_x \equiv abr\mod n$...

I do not see why this couldn't be possible, being given so much slack on the variables... But since I don't have time right now to actually try it out, I'll try to do it later or another day and will edit this answer accordingly.

• Great answer thank you for taking the time, I will also have a look into whether this is possible and mark once determined. Sep 27 '17 at 13:12
• Notice that if you can provide directly the hashed value like in PureEdDSA then it's easy to do. The hard part is to find a message which gets hashed into $abz$, knowing the relationship between $a$ and $b$. But maybe there is a way to add even more slack in the process by multiplying the $s$ value by a third variable $c$ and so we would just need to select it such that $(ack\times G)=abr$. I'll try to verify this later I've just thought of it.
– Lery
Sep 27 '17 at 13:48
• @Chris Alright, my proposal is definitely not possible with ECDSA, since you have to know the $k$ value. This might be possible using deterministic ECDSA, but then it adds one more hard constraint: the modified message must then hash into a suitable $k'$, which is something pretty hard to control...
– Lery
Sep 28 '17 at 4:59
• Thanks, appreciate the attempt and contribution. That's in-line with my prior findings but with a different method I hadn't considered. Sep 28 '17 at 7:03
• Because then the $b$ cancels out with the $b$ contained in the value $(bs)^{-1}$, on line 5 of the verification process in my post (first the red $s^{-1}$ value).
– Lery
Sep 28 '17 at 10:51

A paper(https://eprint.iacr.org/2018/660.pdf) in Asiaccs 2019 seems to have constructed one. But it did not give a security proof. Not sure if it is secure. Hope it can help you.