Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Here's a blind signature protocol based on ECC. The question is if it has the double spending problem?
As I investigated, if we can change the c without changing the r and subsequently no change on m^, then there would be two different (F, s) for a single m.
And this can be achieved if considering F as (x, y), one can find another point on the curve with (x, -y) coordinates.
There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it doesn't matter if you have more than one signature for it.
Second thing is that, even there are two pairs for single $m$, given one of them it's hard to find the other. Proof:
Given point $F$ with coordinates $(x,y)$, coordinates $(x,-y)$ correspond to point $-F$. So to have valid $s$ you have to calculate $c'$ that satisfies:
$-F=b^{-1}R+ab^{-1}G+c'G$
After transformation:
$c'G=-F-b^{-1}R-ab^{-1}G$
Let's set
$C=-F-b^{-1}R-ab^{-1}G$.
Then we get:
$c'G=C$
and this is exactly discrete logarithm problem.
