2
$\begingroup$

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally ”blind”, conditionally ”unforgeable" (as highlighted in the following paragraph). How do you define blindness and unforgeability? Please explain. If possible give an illustration.

There is a possibility of guaranteeing the anonymity of voting unconditionally by means of conventional, i.e. classical cryptography, based on mathematical encryption. The corresponding voting protocol is based on the principle of ”sender untraceability”, meaning such a communication scheme, where the recipient of several messages from several senders cannot determine which message came from which sender. Such a communication can be realized with unconditional security in the sense that the recipient is unable to establish any relation between the messages and the senders, even being in possession of infinite computational power. However, the very property of untraceability creates, in the case of voting, an additional problem of determining which ballots come from legal voters, since illegal participants can send ballots in an untraceable way. This problem is solved by a special ”ballot issuing” protocol (based on the technique of ”blind signature”) providing each legal voter with an ”unforgeable” and ”blind” digital ballot, which is used for sending a vote. The term ”unforgeable” means that the ballot cannot be cloned, while the term ”blind” means that the ballots are in no way related to the identities of legal voters. The ballots in the ballot issuing protocol are unconditionally ”blind” but only conditionally ”unforgeable”, that is a person in possession of rich enough computational power is able to vote instead of legal voters. Thus, the property of ”non-exaggeration” is realized by the overall voting protocol in a conditional way only.

$\endgroup$
1
$\begingroup$

It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{N}$ so even if you have unlimited computational power you can't extract $m^d$ from looking at $r \cdot m^d$. Even if you factor $r \cdot m^d$ you won't know for sure which parts belong to $r$ and which to $m^d$.

However if you have infinite computational power you can just find $d$ from $(N, e)$, hence it is conditionally (computationally) un-forgable.

| improve this answer | |
$\endgroup$
1
$\begingroup$

Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined.

In case if you don't want to deep dive into the paper, then I give you hereby a high-level description of the corresponding games.

  • Unforgeability: in the unforgeability experiment we allow our adversary $\mathcal{A}$ to interact $k$ times with an honest signer. Hence adversary $\mathcal{A}$ has now $k$ valid message, signature pairs. If, for every adversary $\mathcal{A}$, the probability that $\mathcal{A}$ can produce yet another valid message, signature pair is negligible, then the blind signature scheme is said to be unforgeable.
  • Blindness: in this security game we restrict ourselves to a single-bit message space, i.e. $b\in_{R}\{0,1\}$. An honest user selects with probability $1/2$ either $0$ or $1$ as the to-be-signed message. The blind signature scheme is said to be blind if for every adversary $\mathcal{A}$, as a signer, cannot decide non-negligibly better than guessing, which message they signed.
| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.