I want to sign a message while not being able to see the message.

Logically, there should be a way, I just don't know how this translates into cryptography.

Here is an illustration for what I mean:

A man writes a message on a piece of cardboard. He wraps the cardboard in carbon paper and brings it to another man.

That other man is the signer. He puts his signature on the carbon paper, which in turn also transmits it onto the original piece of cardboard. However, the signer is not able to see the message, since it is hidden in the carbon paper. (The fact that the paper is fragile is without loss of generality, one can image something more tamper-proof of course).

The first man then returns home where he unwraps the piece of cardboard, with the message which is now signed by the signer. But the signer does not know the message still.

There are use cases for this and I would be very interested how this could be reproduced in cryptography.

EDIT: Trying to clarify something, I am sorry my inability to be more clear:

The thing is that the message creator may want to pass the message to third parties that he does not trust. It must be possible for a third party to read the message and verify that the message was signed by the signer. But, assuming that the signer signs many messages every day, it should not be possible for the signer and the third party to cooperate in order to identify which message the signer signed WHEN.

  • 4
    $\begingroup$ What you're looking for is called blind signatures. $\endgroup$ – Maeher Oct 12 '18 at 22:31

You are almost certainly looking for blind signatures.

I'm not sure what else there is to say on the subject, there are various schemes that offer this solution e.g. the RSA and ECDSA variants listed in the provided link.


Generally hashing is part of the signature generation. You can use an additional hash or perform the hashing beforehand (splitting the signature generation process), and then only present the hash to the signer. If the message is complex enough then the one-way-hash function hides the message so it cannot be guessed.

You can always include a large enough (128 bit or so) random value with the message so it is impossible to guess the input to the hash value. Of course the receiver has to receive the message and the random value to verify the signature.

A much bigger problem is to make sure that the signer signs the actual message displayed on screen, and not a different hash. So the normal use case of a signature is actually harder to accomplish than your specific task to hide the message.

  • 2
    $\begingroup$ Perhaps I didn't understand the question well enough, but I was all but certain that blind signatures would be (at least part of) the answer here. Is there a reason you don't mention them? $\endgroup$ – Ella Rose Oct 12 '18 at 21:23
  • $\begingroup$ I blind type this without even looking at the screen, but blind signatures I haven't used much. So I leave it to somebody else to write up that answer. $\endgroup$ – Maarten Bodewes Oct 12 '18 at 23:20
  • $\begingroup$ @EllaRose "Blind signature" is exactly what I was looking for. The wikipedia article even mentions "carbon paper" :) en.wikipedia.org/wiki/Blind_signature $\endgroup$ – Konstantin Schubert Oct 13 '18 at 18:55
  • $\begingroup$ @EllaRose You were the first one mentioning blind signatures, would you want to write a quick answer that I can accept? $\endgroup$ – Konstantin Schubert Oct 13 '18 at 18:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.