Here's a blind signature protocol based on ECC. The question is if it has the double spending problem?
As I investigated, if we can change the c
without changing the r
and subsequently no change on m^
, then there would be two different (F, s)
for a single m
.
And this can be achieved if considering F
as (x, y), one can find another point on the curve with (x, -y) coordinates.