7
As @CodesInChaos explains:
It might refer to blind signatures.
It also might refer to a method to harden (typically) RSA implementations against timing/side-channel attacks, by blinding the data before operating on it.
Example: suppose you are writing code to decrypt data, i.e., to compute $y=x^d \bmod n$, given the input $x$. The naive way to do is just ...
6
How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign.
Assuming that the $r$ values are chosen uniformly from the values $[1, N-1]$ relatively prime to $N$ (and kept secret, for example, zeroized after use), and none of the $m$ values are relatively prime ...
6
Designing such signature schemes from scratch without having strong experience is very likely to fail and very dangerous (see the tons of bad papers out there being accepted to "dubious" conferences and journals).
Your proposed scheme
Your verification relation is to check if: $sP - Q + R \stackrel{?}{=} zP + mP$ where $Q$ is the public key of the signer ...
6
Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing friendly elliptic curve groups.
This blind signature scheme can be based on the compact BLS-signature scheme (which is based on gap-DH groups, i.e., groups in which ...
6
I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out:
Blind signatures for untraceable payments, Chaum
Provably secure blind signatures schemes, Pointcheval
By the way if you look at the introduction of the second title it seems what your looking for.
A ...
6
As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works.
Remarks from the previous ...
6
The answer is correct, you don't need to unpad the message.
When/if you verify the signature, simply check that $(\text{signature})^e == \text{pad}(\text{message})$
Regarding the padding scheme, you can just use a full domain hash.
Here's how you implement a full domain hash:
$$ \mathrm{cycles} = \frac{\text{(RSA key length)}}{\text{(SHA digest length)} \...
5
I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).
However I do not believe this is impossible. So let's try to do this for ECDSA:
We have a message $m$ whose hashed value $H(m)$ is converted into an integer $z$ which gets signed into the signature $(r,s)$ by the signer....
5
I'm not really familiar with blind signature schemes, so please take the following with a grain of salt, but what you describe looks like a really funny way to apply padding. Normally, one would pad the message (using a suitable padding scheme like RSA-PSS) before the first RSA operation, i.e.
$\text{padded message = pad(message)}$
$\text{blinded message = ...
4
In the blind RSA signature scheme the blinding of a message
$m$ (to be blindly signed) is multiplicative with value $r^e$, where
you ensure that $r$ is invertible modulo $N$.
So if the sender receives the signed blinded message back from the
signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv
m^d \pmod N$ which is a valid (textbook) RSA ...
4
The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using RSA, where $(e, N)$ is $\mathcal{B}$'s public key and $d$ is it's private key, this may look like:
$\mathcal{A}$ computes $x = m*r^e \mod N$, where $r$ is a ...
4
You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$.
On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...
3
There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it doesn't matter if you have more than one signature for it.
Second thing is that, even there are two pairs for single $m$, given one of them it's hard to find ...
3
This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice problems.
But this isn't surprising, because lattice problems can be used for:
building post-quantum encryption schemes, key exchange, signatures, etc.
...
3
It's impossible:
Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
3
If you are not limited to HMAC, blind signatures would meet your requirements.
In RSA, you can do blind signatures as follows:
Let $M$ be the message to be signed (probably the hash of a message) and let $e,N$ be A's public key, $d$ is A's private key.
B computes $M' = M\cdot r^e \bmod{N}$ and sends $M'$ to A.
A computes $S' = M'^d\bmod{N}$...
3
You are wrong. The purpose is to prevent linking the signing operation with the verification operation.
For instance, suppose that I have to identify myself when I ask B to sign the thing (maybe B charges me to create a signature; for instance, when blind signatures are used for e-cash, B is the bank, and B charges money to sign anything, since validly-...
2
No, that is not correct. You appear to have a misconception about how RSA signatures work.
Here is how an RSA signature is generated:
You take your message $M$
You apply a padding function to create a value $m = pad(M)$
You then use the RSA private key to compute $m^d \bmod N$
Now, this last step isn't always done in the straight-forward manner. With ...
2
So let's first recall how blinded RSA works:
Select primes $p=11$ and $q=19$, calculate the modulus $n=pq=209$, choose a public exponent $e=7$. Now calculate the signature exponent $d\equiv e^{-1} \pmod{(p-1)(q-1)}$ ($d=103, (p-1)(q-1)=180$).
Now let's go to the message-dependant processing:
A message $M$ is represented as the integer $m=16$ which is ...
2
This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you fix that by pretending any of it makes sense the whole thing is trivially breakable. Throw it away and forget the whole ordeal—except don't forget that the ‘...
2
Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs involve the simulator responding to random oracle queries in a way that will necessarily make their signatures validate, which they can do because they have control ...
2
The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures:
Lets say we want to blindly sign distinct messages $m_1$ and $m_2$ with distinct randomness $r_1$ and $r_2$.
Now during the blind signing you produce the transcripts (I omit $\mod N$):
$m_1'=...
2
Till today, there is no known construction for this. The problem is that standard hash functions do not come with the necessary algebraic properties required for blinding and unblinding.
2
lattice-based blind signature scheme: “Lattice-based Blind Signatures” (PDF)
MQ-based blind signature scheme: “A Practical Multivariate Blind Signature Scheme” (PDF)
code-based blind signature scheme: “A Step Towards QC Blind Signatures” (PDF)
1
Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined.
In case if you don't want to deep dive into the paper, then I give you hereby a high-level description of the corresponding games.
Unforgeability: in the ...
1
It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{N}$ so even if you have unlimited computational power you can't extract $m^d$ from looking at $r \cdot m^d$. Even if you factor $r \cdot m^d$ you won't know ...
1
Blind signature works as follows:
(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $
(2) the signer will blindly sign the value by raising it to its private key $d$, as $ \sigma'^d = b \cdot M^d $
(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\...
1
There are random oracle model security proofs for RSA-PSS and RSA-FDH. There are standards for RSA-PSS but it requires randomness from the signer and thus does not work for blind signatures. RSA-FDH works with blinding.
RSA-FDH might appear in some standard somewhere, but honestly "full domain hash" is kinda self explanatory to a cryptographer. As an FDH ...
1
Well, I think it is quite hard to give a really objective and complete answer to this question.
Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure
if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite ...
1
Signatures do not keep the message secret.
Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$.
Efficiently generating an $s$, $c$ pair requires knowing the private key, so that raising to $s$ can cancel the $g^x$.
Only top voted, non community-wiki answers of a minimum length are eligible
