I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation. In particular, I'm using this formulation from this link:

User U chooses blinder r and blinds message m with

m' = r^e H(m) mod n

and submits m' to the server. He receives a signature s for H(m).

Now, my original m should have two delimited fields, a serial number S and a value V, and although S should remain unknown to the bank, the bank wants to know for sure that it is encrypting V and not some other value. It is important that the user shows S at the time of spending the key, but that this cannot be linked back to the request for the blind signature.

For the V part, I'm thinking of using a ZK proof, specifically a Sigma-protocol, to prove V is encoded in the hash. To do this, I'm planning to use a Pedersen hash, on a group G with known generators g,h such that their relative discrete log is not known.


H(m) = H(S, V) = g^S h^V

The User would send to the Signer a blinded value

m' = r^e H(S,V) mod n

where the group element H(m) is serialized and interpreted as an integer.

The user would also send a ZK Proof for these statements:

Private Inputs: r, S, A
Public Inputs: m', e, V, g, h, n

m' = r^e * A
A  = serialized version of g^S h^V

The signer does not really care about the format of S, as long as there is something in there. What it wants to be certain of is that the value it is signing, V, is what has been publicly revealed (so that it can deduct the owner's account by the correct balance).

If the proof is correct, the Signer signs the message m' and the User unblinds it to become s = H(m)^d.

When the user spends the note, he will present the values (S, V, s). A merchant can verify the signature by checking

VerifySig(s, H(S, V)) == True

and checking if that S has already been seen before (to prevent double-spend). Importantly, neither S nor H(S,V) have been revealed previously, so this spending is not linkable to the note creation.

I can see there is a frail point in bringing a group element in a proof of multiplication in an RSA-like group. And I haven't written the details of Sigma-proof yet. But does it look like this is a feasible approach, or would there be easier ways to do this?

I want something secure, of course, but my main concern at the moment is performance and as low interactivity as possible. Therefore, I would not like to use a cut-and-choose model.

Any help would be appreciated. Thanks.

  • $\begingroup$ Can you provide a working link, please? Your link doesn't work. $\endgroup$ – Martin Kromm Nov 22 '19 at 16:58
  • $\begingroup$ Done, thanks for pointing it out. $\endgroup$ – Alex Pinto Nov 23 '19 at 23:03
  • $\begingroup$ Just to add a bit more, I have not had the time yet to read the Survey I link to in the details. It seems partially-blind signatures may solve my problem, but there may be better options out there I'm not familiar with. $\endgroup$ – Alex Pinto Nov 23 '19 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.