Here's a blind signature protocol based on ECC. The question is if it has the double spending problem? A blind signature protocol

As I investigated, if we can change the c without changing the r and subsequently no change on m^, then there would be two different (F, s) for a single m. And this can be achieved if considering F as (x, y), one can find another point on the curve with (x, -y) coordinates.


1 Answer 1


There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it doesn't matter if you have more than one signature for it.

Second thing is that, even there are two pairs for single $m$, given one of them it's hard to find the other. Proof:

Given point $F$ with coordinates $(x,y)$, coordinates $(x,-y)$ correspond to point $-F$. So to have valid $s$ you have to calculate $c'$ that satisfies:


After transformation:


Let's set


Then we get:


and this is exactly discrete logarithm problem.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.