# Is there a standard padding/format for RSA Blind Signatures?

I'm working on a RSA blinded signature scheme. RSA Blind signatures are discussed in Chaum's original paper and other places like wikipedia.

The descriptions of RSA blind signatures are straight forward, but they seem to use the original message rather than a formatted or padded message. According to Rabin (1979) we should be using at least H(m).

My question is, is there a standard covering RSA Blind Signatures we should be using? Is there an accepted way to format the message when used in a RSA Blind Signature scheme?

I know the question has some open ends, like security goals being under specified. But we are looking for something that provides intractability of signature-forgery and enjoys some interoperability. I'd like to say we want all the security properties detailed by Bernstein in RSA signatures and Rabin–Williams signatures: the state of the art, but I won't go that far.

Related, here are two questions that explain how to provide a padding function at the author (as opposed to the signer). Both appear to be ad hoc methods.

• Unlikely! I'd just build a full-domain hash out of SHAKE256 with double-length reduction to be safe from modulo bias. Say your modulus has 2048 bits; for message $m$ and blinding factor $r$, use blinded message $m' = r^e h \bmod n$ where $h$ is some integer interpretation of SHAKE256-4096(m). Make sure to include all information you care about in the input to SHAKE256, and maybe add an application label for domain separation just for good measure. – Squeamish Ossifrage Dec 19 '17 at 23:41
• Thanks @SqueamishOssifrage. Since I can't seem to find a standard I'm guessing I may have traveled down the wrong path. What is the modern equivalent to a blind signature? What should be used nowadays? – user10496 Dec 19 '17 at 23:52
• Depends on what you're trying to do. What are you trying to do? Maybe blind signatures are what you need, maybe not. There just aren't a lot of widespread applications out there that use them, so I don't think they're standardized anywhere. Want an interoperable standard? If you have an application that warrants interoperable standardization, you could be the one to write the RFC for the IETF on it! If it's practically justified, there's probably a cryptographer who can help with the details, because everyone thinks blind signatures are pretty cool. – Squeamish Ossifrage Dec 19 '17 at 23:56
• @SqueamishOssifrage - There are two instance problems. First, I help with a free/open source crypto library. A generalized blind signature scheme would make a good addition. Second, there's a fellow asking for a scheme. I don't know the exact details of the request, but the cryptographic primitive was selected. I've also seen similar requests for other libraries, like Botan and OpenSSL. – user10496 Dec 20 '17 at 0:30