Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [blinding]

Technique mainly employed for factorization based cryptosystems to hide information. Usually blinding involves using a multiplicative homomorphic property of the cipher, it may be used to realize blind-signatures. It's also commonly used to protect cryptosystems like RSA and Rabin-Williams against ...

1
vote
1answer
69 views

RSA encrypting private keys blinding

I am studying RSA couldn't understand this question: Alice encrypts the private factors of the modulus using her private key. In order to increase security, she multiplies them with a random integer $...
2
votes
1answer
35 views

How do I choose blind sizes?

I am currently developing a service that calculates statistics (currently only sum/average) on homomorphically encrypted user data, and then gives the results to a third party. Because encryption is ...
3
votes
1answer
70 views

Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

I've been reading up on blind signatures and am trying to wrap my head around the concept - specifically in the context of anonymous blockchain transactions using vouchers. One particular issue I'm ...
2
votes
2answers
139 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
1
vote
1answer
89 views

One time blinding threshold encryption?

Paillier cryptosystem has self-blinding property. (change one ciphertext into another without changing the content of its decryption) Is there any threshold encryption scheme (or just encryption ...
8
votes
1answer
246 views

Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
1
vote
1answer
273 views

Protocol for Sharing Blinding Factor with RSA

What is the protocol for choosing blinding factor when RSA is applied with key blinding? (Related question: How would you find the Blinding factor R in RSA blind signature algorithm?) Since blinding ...
2
votes
1answer
425 views

Intuition for Schnorr Blind Signatures

I was studying the Blind schnorr signatures in this paper (PDF) which says that the signer sends a commitment $$r=g^{k}\bmod p$$ which the user blinds with 2 random elements $a,b$ to get $$r'=r\...
4
votes
3answers
90 views

Recovering a secret that has been blinded several times

I'm analyzing a protocol that, during one of the steps, sends a blinded secret. Let's denote the secret $x \in \mathbb Z_p^*$ (for $p$ prime) and the blinded secret $y$, so that $y = r\cdot x \bmod p$,...
1
vote
0answers
99 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
3
votes
3answers
341 views

Is multiplicative blinding less secure than additive?

It's easy to see that additive blinding (e.g., $x+r$ for secret x and random r) is perfectly secure in a finite field (this is a one-time-pad) and statistically secure for $r$ uniformly distributed in ...
6
votes
2answers
143 views

Data Leakage and Data Switching

I have two secret values $a$ and $b$ (i.e. they are arbitrary values). I mask them as follow: $v_1=r_1a+r_2$ $v_2=r_1(b-a)$ where $r_1$ and $r_2$ are uniformly random values. I send $v_1$ and $v_2$ ...
4
votes
0answers
246 views

Elliptic Curve Blind Signature Implementation

I have seen this prior post: Elliptic Curve based blind signature implementation Currently I'm sizing up how difficult it would be to attain Elliptic Curve Blind signatures for an application I'm ...
1
vote
2answers
176 views

Can one construct OTPs without using XOR?

The typical version of the one-time-pad (OTP) uses XOR to combine a key pad and a message. ($c=m\oplus k$) Now let's assume some other scenarios which have the practical application of blinding. Do ...
3
votes
0answers
137 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
5
votes
0answers
116 views

Blinding to mask private key operations

Blinding is often used to mask private key operations when the underlying problem is integer factorization. For example, its used in both RSA and Rabin-Williams signature schemes. This presumes ...
0
votes
1answer
54 views

Blinding value of particular form

I'm working with an implementation that creates a blinding value for RW signatures with the following C++ code: ...
2
votes
1answer
109 views

Rabin-Williams, blinding and size of Integer r?

I was reading the paper Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery. But my ...
4
votes
1answer
288 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
2
votes
0answers
215 views

RSA Key Blinding

I was looking the answer to the following question (Timing attack on modular exponentiation), discussing the Private Key Blinding as a countermeasure for timing attacks. Therefore I'm asking if ...
8
votes
1answer
2k views

What is “Blinding” used for in cryptography?

What does "blinding" mean in cryptography, and where do we usually use it? Can you describe a sample implementation?