Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme

Question

I am a noob to cryptography in the sense that I have only little understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA cryptography and also Chaum's Blind Signature scheme as described in the wikipedia article on RSA Blind Signatrures.

I did find an implementation of this scheme that I can use successfully to blindly sign using vanilla RSA.

However my problem is as follows: I need to be able to generate a SHA256 pkcs1v1.5 RSA signature based on the same blinding scheme described in the article I linked to before.

I understand that RSA Blind Signatures are less secure in general. However I do not intend to use the same keypair for encryption.

I have read up a little on pkcs1v1.5 RSA signatures and from what I could gather, they use 'padding', in addition to some other techniques to make RSA more viable.

The pkcs1v1.5 specification has a comment that states

Note. Another way to implement the signature verification operation is to apply a "decoding" operation (not specified in this document) to the encoded message to recover the underlying hash value, and then to compare it to a newly computed hash value. This has the advantage that it requires less intermediate storage (two hash values rather than two encoded messages), but the disadvantage that it requires additional code.

I am aware of this post that details that this is possible if the sender, or the 'Signee' does the padding before sending the message to be signed. On similar lines, what kind of padding and other methods do I have to employ in order to generate a pkcs1v1.5 Signature, so that any third party, knowing only N and E can verify this Signature using the normal method or the 'decoding method' quoted above?

Answer 1

I can't believe it but I actually found an answer.

The following js code does exactly the padding scheme as detailed in the EMSA-PKCS1-v1.5 message encoding specification

function messageToEMSA_PKCS1_v1_5(message){
    // https://www.rfc-editor.org/rfc/rfc3447#section-9.2
    SHA256_DIGEST_INFO = "30" + "31" + "30" + "0d" + "06" + "09" + "60" + "86" + "48" + "01" + "65" + "03" + "04" + "02" + "01" + "05" + "00" + "04" + "20" ;
    T = SHA256_DIGEST_INFO + sha256(message);
    t_len = 51; // Just T.length 19 octets from the Digest Info + 32 octets from SHA-256

    ps_len = 256 - t_len - 3;
    PS = "ff".repeat(ps_len);

    EM = "00" + "01" + PS + "00" + T;
    console.log(`EMSA-PKCS1-v1_5 encoded Message: ${EM}`);
    return EM;
}

Following this, the blind signature after being unblinded, would be a valid pkcs1v1.5 signature