Skip to main content

Questions tagged [blind-signature]

In a blind signature scheme, the signer does not know what he is signing. This is an important building block of anonymous voting or digital cash schemes, because it allows an authority to control the creating of signed messages, but doesn't allow it to track their use.

Filter by
Sorted by
Tagged with
1 vote
0 answers
73 views

Privacy-Preserving User Tracking Across Systems with Homomorphic Encryption or hashing

I'm working on a project where we have three different software systems—let's call them A, B, and C. Systems A and B handle user data identified by phone numbers and want to send user actions to ...
Mr Alihoseiny's user avatar
1 vote
0 answers
40 views

Is there a type of method where multiple keys are involved, and final key produces invalid results unless all prior keys are used?

I'm looking for a mechanism for a type of cert/key signing, where multiple keys need to sign/encrypt something, and a final key/method does not product a valid confirmation unless all those keys did ...
New Alexandria's user avatar
1 vote
0 answers
94 views

ABE and OKAMOTO definition of partially blind signature scheme

I'm trying to understand the definition of a partially blind scheme that is described with Game A presented in Abe and Okamoto paper In line 5 is $msg_0$ correct or should it be replaced by $(info_0,...
Panos's user avatar
  • 41
2 votes
1 answer
69 views

Is a non-correlating signed identity proof possible?

Is it possible to receive from a party $I$ a signed message $M$ that can be presented to two independent other parties $V_1$ and $V_2$ as $M'_1$ and $M'_2$ in such a way that they cannot establish a ...
no1dea's user avatar
  • 31
3 votes
1 answer
243 views

Details about blind signature on ed25519

Recently, I started looking up for details about implementing a blind signature on ed25519 cryptographic. I saw this article https://stan.bar/blindsig/ by Stanislaw Baranski about it. In the first ...
user10002393's user avatar
1 vote
0 answers
139 views

Can a blind "semi-HMAC" scheme using a hash of a blind signature avoid the problems of (provably insecure) blind HMAC schemes?

The impossibility of a secure "blind HMAC" scheme - an HMAC-based analogue of blind signatures - is known (as I understand it, essentially due to the user being unable to validate the ...
DodoDude700's user avatar
1 vote
0 answers
70 views

Security of anonymous group credential issued over multiple user secret keys plus a common/public system message

In a group signature scheme based on Pointcheval-Sanders (PS) single-message signature, the anonymous credential $(\sigma_1,\sigma_2)$ issued by the group manager (GM) with secret key $sk = (x,y) \in \...
Star Seller's user avatar
3 votes
0 answers
70 views

Security of Blind Signature Schemes in the Concurrent Setting

I am quite confused about the security definition of blind signature schemes in the concurrent setting. I have found a paper as follows showing that most of the previous blind signature schemes cannot ...
Chris Huang's user avatar
1 vote
1 answer
101 views

Is there a blind signature that can sign on a commitment?

For the blind signature that can sign on a commitment, I mean finally, the user can get a signed commitment, rather than a signed message inside the commitment. It means the verification also takes a ...
user77340's user avatar
  • 797
0 votes
1 answer
91 views

RSA Blind Signatures Secure Implementation

note: I am not a crpytographer I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so ...
Mohammed Rady's user avatar
2 votes
1 answer
71 views

Is it possible to de-anonymize user in RSA blind singing without knowing the random blinding factor only?

For example, in case of using RSA blind signing in E-Voting protocol: Is it possible to trace (Sx, x) to (Sb, b) if Signer and Tallier is the same person? In this case, attacker has access to: ...
Serbin's user avatar
  • 123
3 votes
1 answer
2k views

Secret key expiration

I am looking for suitable techniques through which secret keys (RSA/ ElGamal / ring signatures secret keys) can be expired after a certain time limit. So far, I found out that only PGP offers ...
Nomana's user avatar
  • 41
0 votes
2 answers
168 views

How can I prove "single-use authorization" from multiple parties without revealing identity?

I've been trying to create a distributed authorization protocol where identities are not revealed. Let me explain with an example. Let's assume we have 4 actors, Alice, Bob, Charlie, and Dan. Alice is ...
Tanmoy Krishna Das's user avatar
1 vote
1 answer
162 views

Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme

I am a noob to cryptography in the sense that I have only little understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA ...
Ev3ryDay1sL3gDay's user avatar
0 votes
0 answers
168 views

How to prove possession of a CL signature in zero-knowledge?

Assume that we have the following signature scheme CL Signature: Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$. Uniformly and ...
Bean Guy's user avatar
  • 742
6 votes
0 answers
139 views

Understanding anonymous credentials. Does someone understand how it works?

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it. I ...
Bean Guy's user avatar
  • 742
2 votes
1 answer
121 views

Is it necessary to prove EUF-CMA security of blind signature based on one-more type assumption?

One more type means one-more DL, one-more DHP, etc. I find many papers do the EUF-CMA security proof in this way. Is it necessary? What is the difference between proof based on one-more type ...
user77340's user avatar
  • 797
0 votes
0 answers
225 views

How does RSA blind signature calculation works?

I am having a struggle calculating (ii) and (iii), Can anybody help me with the calculation? RSA blind signature algorithm: Given two prime numbers: $p=11$ and $q=3$ The message to be signed is: $M=6$ ...
Navid Niknezhad's user avatar
0 votes
2 answers
232 views

How to prove that I am part of a list without revealing my identity?

Let's suppose and scenario like a secret voting scheme, at the ID verification step. Considerations: There is a public list of identities of people who are able to vote (ex, people who live in a ...
Fabricio Espinoza's user avatar
3 votes
1 answer
243 views

How to achieve identity authentication without revealing credentials

I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
Zoey's user avatar
  • 261
2 votes
1 answer
71 views

Why blinding integer $r$ needs to be co-prime with $N$ in blind RSA signature

According to blind RSA signature wiki the random value $r$ in $m^\prime=mr^e \bmod N$ needs to be relatively prime to $N$. Why is this a requirement? A follow up a related question: after $s$ (...
DeLorean88's user avatar
1 vote
0 answers
52 views

Do practical blind signature schemes make compromises?

I am fascinated by the idea of blind signatures and their applications introduced by David Chaum for electronic cash and voting and his provided analogy with carbon copy is quite compelling. However ...
Jānis Erdmanis's user avatar
1 vote
0 answers
253 views

Proof ownership of private key for blinded public key

so i want to prove to a server that i have the private key to a public key for which i want to retrieve the server's signature. But the server is not allowed to learn either public nor private key. ...
flying_duck's user avatar
4 votes
0 answers
149 views

The security of blind RSA signatures with modular exponentiation as padding

It is known that (blind) RSA signature implementations should apply some sort of padding to messages before signing or blinding them. Does blind RSA signature with modular exponentiation as a padding ...
István András Seres's user avatar
1 vote
1 answer
128 views

Regarding security of blind signature schemes

I'm new to blind signatures, trying to understand security notions of it: blindness and one-more unforgeability. I found out that in the security game for blindness property, the adversary $\mathcal{...
Cryptomath's user avatar
2 votes
2 answers
205 views

What is blindness and forgeability in Chaum's blind signature scheme?

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally ”blind”, conditionally ”unforgeable" (as highlighted in the ...
Adam Levine's user avatar
2 votes
0 answers
65 views

Need help in proving of disproving security of generic partially-blind-signature construction

I have a project where I need to use a linear partially blind signature scheme. I looked at Abe-Okamoto, but I can't easily make it linear. So I looked at Okamoto-Schnorr blind signatures (here and ...
Alex Pinto's user avatar
1 vote
0 answers
87 views

Looking for a partially blind multisignature scheme?

I am working in a project inspired in digital cash where we would like to use partially-blind signatures. This is so that the Bank signs a check with a hidden serial number (S), but a plainly visible ...
Alex Pinto's user avatar
3 votes
1 answer
912 views

Complexity of computing zk-SNARK Proofs

Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated. Q: What ...
crypto9294's user avatar
2 votes
0 answers
244 views

ZK Proof that a blinded message (for a blind signature) contains a certain value

I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation. In particular, I'm using this formulation from this link: User ...
Alex Pinto's user avatar
1 vote
0 answers
59 views

Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version?

Q: Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version? I am searching for an algorithm where you can see what happens if you ...
sycx2's user avatar
  • 11
1 vote
1 answer
282 views

blind signature

Reading this paper, I have some questions about blind signatures What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly. In blind signatures (...
Laura's user avatar
  • 377
1 vote
0 answers
200 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
jhnn's user avatar
  • 123
3 votes
1 answer
229 views

Double spending on a given Blind Signature over ECC protocol

Here's a blind signature protocol based on ECC. The question is if it has the double spending problem? As I investigated, if we can change the c without changing ...
mtoloo's user avatar
  • 133
13 votes
0 answers
695 views

Potential Flaws With Lattice Based Cryptography?

From researching post-quantum cryptographic schemes it seems hash-based and lattice-based algorithms are the most promising (MQ-based seem to be covered by patents and have more potential unknowns ...
CoryG's user avatar
  • 559
4 votes
1 answer
153 views

Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

I've been reading up on blind signatures and am trying to wrap my head around the concept - specifically in the context of anonymous blockchain transactions using vouchers. One particular issue I'm ...
CoryG's user avatar
  • 559
5 votes
2 answers
668 views

Post-Quantum Blind Signatures?

Are there any post-quantum blind signature algorithms? Since hash-based blind signature schemes have proven to by impossible (based on a response to this question) is this an active area of research ...
CoryG's user avatar
  • 559
2 votes
2 answers
313 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
CoryG's user avatar
  • 559
7 votes
1 answer
559 views

Is there a standard padding/format for RSA Blind Signatures?

I'm working on a RSA blinded signature scheme. RSA Blind signatures are discussed in Chaum's original paper and other places like wikipedia. The descriptions of RSA blind signatures are straight ...
user avatar
2 votes
0 answers
321 views

Missing step in Schnorr's proof that an attack on blind signatures requires solving ROS?

In Security of Blind Discrete Log Signatures Against Interactive Attacks C.P. Schnorr defines the ROS Problem and claims that a $(l+1)$ attack against his blind signature scheme is equivalent to ...
Andrew Poelstra's user avatar
6 votes
2 answers
1k views

Are (EC) DSA blind signatures possible?

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible. I've been attempting to articulate why and I think ...
Chris's user avatar
  • 809
1 vote
1 answer
98 views

Is this schema secure?

I want to know if we use function H as random oracle in RSA Blind Signature and assume that RSA Assumption is correct, is it true that the ...
ThisIsMe's user avatar
6 votes
1 answer
865 views

How secure is a blind signature?

From Wikipedia: Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be ...
jornane's user avatar
  • 519
1 vote
0 answers
97 views

Digital cash and blind signiture: coherence between signature and serial number

My question is about the basics of the topic "creating digital cash". At the very beginning of that topic the amount of the banknote and a serial number are the requirements for generating a ...
StellaMaris's user avatar
5 votes
1 answer
163 views

Blind signatures security

I was reading up on blind signatures. I came across the following paragraph in this paper. Previous methods of proofs used to establish security arguments for signature schemes no longer work ...
pd176's user avatar
  • 277
1 vote
0 answers
197 views

What are the best practice, and standard tools for blinding algorithms?

I'm developing an app that uses blind signatures. I'm having a hard time finding tools, and best practices for blinding. There is no PKCS. And everywhere I go, I find caveats of different blind ...
cowlicks's user avatar
  • 151
1 vote
0 answers
140 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
driver4567's user avatar
3 votes
1 answer
235 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ — ...
Inversion's user avatar
  • 133
4 votes
0 answers
798 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
Joshua Zeidner's user avatar
1 vote
0 answers
157 views

Is the half-homomorphic property of RSA a problem for blind RSA signatures?

For blind RSA signatures, is it problematic that RSA is half-homomorph? Take a scenario where blind RSA signatures are used for something like a voting procedure or this proposal: Lots of people, ...
thejh's user avatar
  • 111