# blind signature

1. What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly.

2. In blind signatures (like RSA), if there is a valid origin signatures pair (m,s), then blind message and corresponding signatures pair (m',s') also valid, but it is existential forgery for adversary (even though m' maybe meaningless or random in piratical), so why it can be a secure signature?

## migrated from security.stackexchange.comMar 28 at 10:32

This question came from our site for information security professionals.

To sign a message $$m$$ with the blind RSA signature, only $$(m,s)$$ is valid. The blind signature $$s'$$ is only "valid" for a blinded message hash rather than any message $$m'$$ because the message should be hashed before getting signed.
More precisely, to sign a message $$m$$, the user needs to do the following: compute the message hash $$H(m)$$, pick a random $$r$$ and compute $$r^e$$ (where $$e$$ is the public verification key) to blind the hash, send $$r^eH(m)$$ to the signer, get a blind signature $$\sigma'=rH(m)^d$$ (where $$d$$ is the secret signing key), and unblind it to $$\sigma=r^{-1}\sigma'=H(m)^d$$. Then, $$(m,\sigma)$$ is defined as valid if and only if $$H(m)=\sigma^e$$. So, knowing that $$\sigma'$$ is "valid" for $$r^eH(m)$$ does not automatically give you a message $$m'$$ such that $$(m',\sigma')$$ is valid.