0
$\begingroup$

note: I am not a crpytographer

I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so grateful to be answered.
I did a lot of research in the last few days and came out with this:

Signature Issuing Stage

  1. Get the public key; exponent $e$, modulus $n$
  2. Generate a random number $r$ that is less than and relatively prime to the modulus $n$
  3. Calculate the hash of the private token $m$
  4. Calculate the blinded message $ M = h(m).(r^emod$ $n) $
  5. Send the blinded message to the server that will return the blinded signature $S = M^d mod $ $n$, where $d$ is the private exponent
  6. Calculate the unblinded signature $s = S.r^{-1}$

If I am correct, this will end up with a private token $m$ and its valid signature $s$

Question 1: How to multiply $h(m)$ and $r^emod$ $n$ ? Won't be the result greater than $n$ ?
Question 2: Can I just use any hash algorithm on $m$ like SHA-256 ?
Question 3: The server won't hash or pad the blinded message before signing it, Is that right and safe ?

Signature Verifing Stage

  1. The client sends its private token $m$ and its signature $s$
  2. The server will check the signature $s^e = h(m)$ $mod$ $n$

Question 4: How to implement a padding scheme to prevent signatures from being faked due to the homomorphic property of RSA ?
Question 5: Is this implementation vulnerable to any attacks ? Are there any improvements ?

Improve this question
$\endgroup$
1
  • $\begingroup$ The equation for $M$ is $ M = h(m).(r^emod$ $n) $ in the question. With good typography I think this gives $M=h(m)\cdot(r^e\bmod n)$. But is that correct? Isn't it $M=h(m)\cdot r^e\bmod n$ ? This can be computed as $M=(h(m)\cdot (r^e\bmod n))\bmod n$. Also, I'm pretty sure it's meant $s = S\cdot r^{-1}\bmod n$ where there is $s = S.r^{-1}$, and the correct typography is $S=M^d\bmod n$. $\endgroup$
    – fgrieu ♦
    Nov 7, 2021 at 19:49

1 Answer 1

Reset to default
2
$\begingroup$

note: I am not a cryptographer

I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so grateful to be answered.

Sorry, but when I hear questions like this, it sounds like:

I am not a surgeon, but I want to perform some heart surgery. I've done a lot of research for a few days, and I want to make sure I understand the basics before I get started...

Ok, I'd not that bad, but it sounds somewhat similar (and if it really is for a 'production-stage application', it might not be all that far off. At the very least, if you get your heart surgery wrong, you'll know right then it didn't work...

With that off my chest, here are some answers:

Question 1: How to multiply $h(m)$ and $r^e \bmod n$ ? Won't be the result greater than $n$ ?

Actually, you multiply them modulo $n$.

Question 2: Can I just use any hash algorithm on m like SHA-256 ? Question 4: How to implement a padding scheme to prevent signatures from being faked due to the homomorphic property of RSA ?

I'm taking these two questions together because they have the same answer. What $h$ needs to be is not the straight SHA-256, but instead one where you perform a hash (such as SHA-256) and then pad the result, using perhaps PKCS 1.5 SSA or PSS (depending on what the verifier would expect).

Question 3: The server won't hash or pad the blinded message before signing it, Is that right and safe ?

In this case, it is right and safe - if the server did either hash or pad the message, it'd mess things up. Remember, you did the hashing/padding in step 4.

On the other hand (to get back to my original comments), if you needed to ask these questions, you might not be ready to implement this yourself...

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks for your answer, I didn't want to implement this myself, as I am not a cryptographer, but I didn't find any implementation that will be safe to use. So I asked about the implementation details, then I will write the code to perform it. I want to make sure of a last thing: To check if a signature is padded correctly I will try to pad the original message and check if the results are equal (like checking the hash of a message). i.e. pad(m) = s. Is that right ? $\endgroup$
    – Mohammed Rady
    Oct 23, 2021 at 16:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.