For the blind signature that can sign on a commitment, I mean finally, the user can get a signed commitment, rather than a signed message inside the commitment. It means the verification also takes a commitment as input. Is there such a blind signature?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
In this paper, the blind signature generates a commitment of the signature and a proof of the validity of this committed signature, then you can check the validity without opening the commitment by using the committed signature. And if you know the randomness of the committed message, you can prove the validity of the plain signature on the committed message by using $\text{AdPrC}$.
-
$\begingroup$ But I need a blind signature that signs on a commitment, rather than a committed message. The difference is that if the blind signature is signing on the committed message, then as long as the message is the same, the signature is the same, which is not what I want. $\endgroup$ Dec 14, 2021 at 10:48
-
$\begingroup$ but maybe if the signature scheme is not deterministic, then it is also OK. $\endgroup$ Dec 14, 2021 at 10:59
-