# Tag Info

Accepted

### How secure is a blind signature?

How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign. Assuming that the $r$ values are chosen ...
• 134k

### Are (EC) DSA blind signatures possible?

I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant). However I do not believe this is impossible. So let's try to ...
• 7,266
Accepted

### Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using ...
• 3,952
Accepted

### RSA Blind Signature Attack

You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$. On the other ...
• 134k
Accepted

### Is there a flaw in this ECC blind signature scheme?

This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you ...

### Post-Quantum Blind Signatures?

This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice ...
• 12.3k

### Blind Hash Signatures?

It's impossible: Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
• 24.1k
Accepted

### Double spending on a given Blind Signature over ECC protocol

There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it ...
Accepted

### Blind signatures security

Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs ...
Accepted

### Anonymity problem after voting with blind signatures

The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures: Lets say we want to blindly sign ...
• 12.1k

• 134k

### Is it necessary to prove EUF-CMA security of blind signature based on one-more type assumption？

One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend ...
Accepted

### RSA Blind Signatures Secure Implementation

note: I am not a cryptographer I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so ...
• 134k
Accepted

### Is it possible to de-anonymize user in RSA blind singing without knowing the random blinding factor only?

Is it possible to trace (Sx, x) to (Sb, b) if Signer and Tallier is the same person? No (assuming that the blinding factor was chosen uniformly at random). Here's how RSA blinding works: to sign a ...
• 134k
1 vote
Accepted

### Is there a blind signature that can sign on a commitment?

In this paper, the blind signature generates a commitment of the signature and a proof of the validity of this committed signature, then you can check the validity without opening the commitment by ...
• 2,191
1 vote

### How can I prove "single-use authorization" from multiple parties without revealing identity?

Referring to Vadym Fedyukovych's answer: Nullifier idea of ZCash could also help. In this case, a proof is constructed with a nullifier, which is generated and kept by Alice, its hash is provided to ...
• 334
1 vote

### How to prove that I am part of a list without revealing my identity?

The scheme that solves your problem is called Zero Knowledge Proof of Set Membership ZKP for Set Memberships use Accumulators. Crypto++ library provides an implementation of the accumulator
1 vote
Accepted

### How to achieve identity authentication without revealing credentials

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
• 16.8k
1 vote

• 209
1 vote

### Are (EC) DSA blind signatures possible?

The below paper gives one; 2021, One-more Unforgeability of Blind ECDSA by Xianrui Qin and Cailing Cai and Tsz Hon Yuen
• 717
1 vote

### Is this schema secure?

Blind signature works as follows: (1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $b^e \cdot M$ (2) the signer will blindly sign the value by ...
• 452
1 vote

### Usability of padding scheme in blinded RSA signature?

Answer by DrLecter looks incorrect. Afaik almost all RSA padding schemes have been deprecated. I believe unblinded RSA would use PSS padding today, but as I explained in https://crypto.stackexchange....
• 1,104
1 vote
Accepted

### RSA-blind signatures vs. DSA-blind signatures

Well, I think it is quite hard to give a really objective and complete answer to this question. Personally, I think that why you may encounter RSA blind signatures quite often is due to it's ...
• 12.1k
1 vote

### How does Schnorr signature actually work?

Signatures do not keep the message secret. Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$. ...
• 314

Only top scored, non community-wiki answers of a minimum length are eligible