Questions tagged [blinding]

Technique mainly employed for factorization based cryptosystems to hide information. Usually blinding involves using a multiplicative homomorphic property of the cipher, it may be used to realize blind-signatures. It's also commonly used to protect cryptosystems like RSA and Rabin-Williams against timing-attacks.

Filter by
Sorted by
Tagged with
6 votes
2 answers
280 views

Blinding an ECDSA private key without learning the private key

I am looking at ways to blind an ECDSA signing key (and verification key respectively). Looking at proposed solutions like the IETF KBSS draft, and the IETF ARKG draft it seems that the ECDSA key ...
Peter Altmann's user avatar
1 vote
0 answers
28 views

Key binding with hidden public key

In my scenario we have the Issuer I, Verifier V and Prover P. Now the prover send some messages to I and I signs these messages with I's private key. These messages can be easily sent from P to V and ...
JNies's user avatar
  • 11
0 votes
2 answers
57 views

Statistical distance for multiplicative blinding

A common way to mask an integer $x$ in a range is to add a uniformly random integer $r$ from a much larger range. More formally, if $x$ lies in $[0,...,2^k)$ and $r$ in $[0,...,2^{k + l})$, then $$\...
user34968's user avatar
1 vote
0 answers
30 views

Efficient oblivous test of plaintext equality for pairs of sets

Suppose we have two sets of ElGamal cipher texts encrypted with the same public key $y$ in a prime order group: $C_i = (g^{r_i}, a_i y^{r_i}) $ for $ i \in \{1 ... n\}$ and $D_j = (g^{s_j}, b_j y^{s_i}...
drydrydesert's user avatar
2 votes
1 answer
96 views

Digital signature scheme with blinded public key

I need a digital signature scheme with the following characteristics, but I don't know what it's called, so I'm having trouble searching for publications about it. It seems likely that something like ...
Martin Kleppmann's user avatar
3 votes
0 answers
57 views

Variant of CCA security for Paillier with blinded decryption oracle

Consider a variant of the Paillier encryption scheme where the message space is restricted to $\mathbb{Z}_q$ such that the RSA modulus $N$ of the Paillier cryptosystem satisfies $N > q + q^2$. I am ...
Prashant Agrawal's user avatar
0 votes
1 answer
77 views

How much risk is there for RSA blinding random number not being relatively prime to N

I'm working on the blinding portion of some RSA code. Some implementations I've looked at don't verify that the random number used for blinding is relative prime to N as described on the Wikipedia ...
ubiquibacon's user avatar
1 vote
0 answers
84 views

How can I prove group membership in an anonymous way?

I want to accredit members so they can pseudonymously give feedback while still being provably part of a group, without a way to give extra accreditations. Suppose a group of 100 members (I decide and ...
Giszmo's user avatar
  • 121
1 vote
0 answers
66 views

Self-blindable certificates + group signatures

I am searching for a scheme supporting group signatures and at the same time permitting the blinding of the message-signature pair. Let me explain. There is a certification scheme proposed by Verheul: ...
Karina Am's user avatar
2 votes
1 answer
219 views

Does the degree of this polynomial matter to achieve zero-knowledge? PlonK question

I was reading the paper PlonK and in the Round 1 of the claim to achieve zero-knowledge by adding random multiples (of degree one) of the polynomial $Z_H = x^n - 1$ to the secret polynomials. Here, $H$...
Bean Guy's user avatar
  • 742
2 votes
0 answers
76 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
Dave's user avatar
  • 357
0 votes
0 answers
70 views

How can I enhance the security level of my RSA code?

I am trying to enhance the security level of my RSA code that I implemented in Python. I tried to add blind operation, randomized algorithm to my RSA code (separately, not together), but I am not sure ...
eileen's user avatar
  • 1
3 votes
1 answer
374 views

Does blinding protect again fault injection attack against RSA with CRT

I know that blinding can be used as a countermeasure against side-channel timing attacks on RSA-CRT: RSA Timing Attack and Prevention through blinding My question is: can blinding also be used as a ...
nature8's user avatar
  • 33
2 votes
2 answers
308 views

What is "blinding" with cryptographic hash functions?

What is blinding with a SHA256() or similar cryptographic hash function? What applications does it have? An answer to a recent question briefly mentioned "Consider blinding before calling an ...
David Cary's user avatar
  • 5,664
0 votes
0 answers
54 views

Is blinded mixing possible?

Alice creates ordered set of $N$ public messages $(m_1,...,m_N)$ and sequentially sends them to Bob. Bob evaluates $N$ functions $E_i(m_1,...,m_N)$ (possibly using a secret random value $r$ and/or his ...
DeLorean88's user avatar
0 votes
1 answer
259 views

Encryption using blinded key

I was wondering whether there are any "blinded" encryption schemas, such as the following: We encrypt message $m$ using $f(k)$, where $f()$ is some blinding function and $c = \text{Enc}(f(k),...
Ziva's user avatar
  • 235
8 votes
1 answer
852 views

Details about ROS attack on blind Schnorr signatures

My question concerns the recently uploaded paper On the (in)security of ROS that describes an expected polynomial-time attack on the unforgeability of Schnorr blind signatures. a) Does this mean that ...
Panagiotis Grontas's user avatar
2 votes
2 answers
200 views

What is blindness and forgeability in Chaum's blind signature scheme?

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally ”blind”, conditionally ”unforgeable" (as highlighted in the ...
Adam Levine's user avatar
0 votes
0 answers
44 views

Secure equivalent for giving an unknown card, applied to magician's card tricks

I suspect that this is already something trivial, but I can't find the answer, probably because I don't know how to search the cryptographic primitive that refers to my problem. Imagine the typical ...
FairLight's user avatar
0 votes
0 answers
99 views

Blinding factor SEAL

For a protocol, I need to blind a ciphertext. I am not sure how to choose the blinding factor. How should I choose the range? What should I consider to offer security? I am using CKKS scheme, the one ...
dilot's user avatar
  • 53
2 votes
1 answer
153 views

RSA encrypting private keys blinding

I am studying RSA couldn't understand this question: Alice encrypts the private factors of the modulus using her private key. In order to increase security, she multiplies them with a random integer $...
doggodonger's user avatar
2 votes
1 answer
53 views

How do I choose blind sizes?

I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is ...
Gasp0de's user avatar
  • 121
4 votes
1 answer
152 views

Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

I've been reading up on blind signatures and am trying to wrap my head around the concept - specifically in the context of anonymous blockchain transactions using vouchers. One particular issue I'm ...
CoryG's user avatar
  • 559
2 votes
2 answers
310 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
CoryG's user avatar
  • 559
1 vote
1 answer
198 views

One time blinding threshold encryption?

Paillier cryptosystem has self-blinding property. (change one ciphertext into another without changing the content of its decryption) Is there any threshold encryption scheme (or just encryption ...
takita's user avatar
  • 509
9 votes
1 answer
876 views

Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
Gilles 'SO- stop being evil''s user avatar
1 vote
1 answer
728 views

Protocol for Sharing Blinding Factor with RSA

What is the protocol for choosing blinding factor when RSA is applied with key blinding? (Related question: How would you find the Blinding factor R in RSA blind signature algorithm?) Since blinding ...
user13311's user avatar
6 votes
1 answer
2k views

Intuition for Schnorr Blind Signatures

I was studying the Blind schnorr signatures in this paper (PDF) which says that the signer sends a commitment $$r=g^{k}\bmod p$$ which the user blinds with 2 random elements $a,b$ to get $$r'=r\...
pd176's user avatar
  • 277
4 votes
3 answers
139 views

Recovering a secret that has been blinded several times

I'm analyzing a protocol that, during one of the steps, sends a blinded secret. Let's denote the secret $x \in \mathbb Z_p^*$ (for $p$ prime) and the blinded secret $y$, so that $y = r\cdot x \bmod p$,...
cygnusv's user avatar
  • 4,952
1 vote
0 answers
140 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
driver4567's user avatar
5 votes
3 answers
698 views

Is multiplicative blinding less secure than additive?

It's easy to see that additive blinding (e.g., $x+r$ for secret x and random r) is perfectly secure in a finite field (this is a one-time-pad) and statistically secure for $r$ uniformly distributed in ...
RevFlash's user avatar
  • 101
6 votes
2 answers
152 views

Data Leakage and Data Switching

I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow: $v_1=r_1a+r_2$ $v_2=r_1(b-a)$ where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ ...
user153465's user avatar
  • 1,583
4 votes
0 answers
771 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
Joshua Zeidner's user avatar
2 votes
2 answers
485 views

Can one construct OTPs without using XOR?

The typical version of the one-time-pad (OTP) uses XOR to combine a key pad and a message. ($c=m\oplus k$) Now let's assume some other scenarios which have the practical application of blinding. Do ...
SEJPM's user avatar
  • 46k
6 votes
0 answers
349 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
SEJPM's user avatar
  • 46k
8 votes
1 answer
324 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, it's used in both RSA and Rabin-Williams signature schemes. This presumes ...
user avatar
1 vote
1 answer
78 views

Blinding value of particular form

I'm working with an implementation that creates a blinding value for RW signatures with the following C++ code: ...
user avatar
2 votes
1 answer
193 views

Rabin-Williams, blinding and size of Integer r?

I was reading the paper Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery. But my ...
user avatar
6 votes
1 answer
585 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
David 天宇 Wong's user avatar
2 votes
0 answers
263 views

RSA Key Blinding

I was looking the answer to the following question (Timing attack on modular exponentiation), discussing the Private Key Blinding as a countermeasure for timing attacks. Therefore I'm asking if ...
Filosopher's user avatar
9 votes
1 answer
5k views

What is "Blinding" used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?
tenfish's user avatar
  • 91