0
$\begingroup$

According to blind RSA signature wiki the random value $r$ in $m^\prime=mr^e \bmod N$ needs to be relatively prime to $N$.

  • Why is this a requirement?

A follow up a related question: after $s$ (unblinded signature) and $m$ (original message) are revealed, can anyone (and not only the signing authority) check the validity of the signature by checking $s^e=m \bmod N$?

$\endgroup$
1
$\begingroup$

Why is this a requirement?

Well, if $r$ has (say) $p$ as a factor, then it makes the unblinding step rather difficult.

The original $m$ has $N = pq$ possible, as does $m^d$; if $r$ is a multiple of $p$, then $mr^e$ has only $q$ possible values; if we pass it to the signer, it'll come back to us with a value $m'^d$ that also has only $q$ possible values. We cannot map $m'^d$ back to $m^d$ (as a single $m'^d$ value would map back to $p$ possible $m^d$ values, and we don't know which one it is.

A follow up a related question: after $s$ (unblinded signature) and $m$ (original message) are revealed, can anyone (and not only the signing authority) check the validity of the signature by checking $s^e=m \bmod N$?

Yes, anyone with the public key can validate it. This is generally true for public key signature algorithms.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.