6
votes
Accepted
How secure is a blind signature?
How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign.
Assuming that the $r$ values are chosen ...
- 134k
6
votes
Are (EC) DSA blind signatures possible?
I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).
However I do not believe this is impossible. So let's try to ...
- 7,266
5
votes
Accepted
Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?
The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using ...
- 3,952
4
votes
Accepted
RSA Blind Signature Attack
You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$.
On the other ...
- 134k
4
votes
Accepted
Is there a flaw in this ECC blind signature scheme?
This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you ...
3
votes
Post-Quantum Blind Signatures?
This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice ...
- 12.3k
3
votes
Blind Hash Signatures?
It's impossible:
Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
- 24.1k
3
votes
Accepted
Double spending on a given Blind Signature over ECC protocol
There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it ...
2
votes
Accepted
Blind signatures security
Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs ...
- 437
2
votes
Accepted
Anonymity problem after voting with blind signatures
The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures:
Lets say we want to blindly sign ...
- 12.1k
2
votes
Unblind a RSA blinded signature
So let's first recall how blinded RSA works:
Select primes $p=11$ and $q=19$, calculate the modulus $n=pq=209$, choose a public exponent $e=7$. Now calculate the signature exponent $d\equiv e^{-1} \...
- 44.7k
2
votes
Accepted
Post-Quantum Blind Signatures?
lattice-based blind signature scheme: “Lattice-based Blind Signatures” (PDF)
MQ-based blind signature scheme: “A Practical Multivariate Blind Signature Scheme” (PDF)
code-based blind signature scheme: ...
- 1,370
2
votes
Blind Hash Signatures?
Till today, there is no known construction for this. The problem is that standard hash functions do not come with the necessary algebraic properties required for blinding and unblinding.
- 2,870
2
votes
Is there a standard padding/format for RSA Blind Signatures?
There are random oracle model security proofs for RSA-PSS and RSA-FDH. There are standards for RSA-PSS but it requires randomness from the signer and thus does not work for blind signatures. RSA-FDH ...
- 1,104
2
votes
Accepted
Why blinding integer $r$ needs to be co-prime with $N$ in blind RSA signature
Why is this a requirement?
Well, if $r$ has (say) $p$ as a factor, then it makes the unblinding step rather difficult.
The original $m$ has $N = pq$ possible, as does $m^d$; if $r$ is a multiple of $...
- 134k
2
votes
Is it necessary to prove EUF-CMA security of blind signature based on one-more type assumption？
One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend ...
2
votes
Accepted
RSA Blind Signatures Secure Implementation
note: I am not a cryptographer
I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so ...
- 134k
2
votes
Accepted
Is it possible to de-anonymize user in RSA blind singing without knowing the random blinding factor only?
Is it possible to trace (Sx, x) to (Sb, b) if Signer and Tallier is the same person?
No (assuming that the blinding factor was chosen uniformly at random).
Here's how RSA blinding works: to sign a ...
- 134k
1
vote
Accepted
Is there a blind signature that can sign on a commitment?
In this paper, the blind signature generates a commitment of the signature and a proof of the validity of this committed signature, then you can check the validity without opening the commitment by ...
- 2,191
1
vote
How can I prove "single-use authorization" from multiple parties without revealing identity?
Referring to Vadym Fedyukovych's answer:
Nullifier idea of ZCash could also help.
In this case, a proof is constructed with a nullifier, which is generated and kept by Alice, its hash is provided to ...
- 334
1
vote
How to prove that I am part of a list without revealing my identity?
The scheme that solves your problem is called Zero Knowledge Proof of Set Membership
ZKP for Set Memberships use Accumulators. Crypto++ library provides an implementation of the accumulator
1
vote
Accepted
How to achieve identity authentication without revealing credentials
The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
- 16.8k
1
vote
Regarding security of blind signature schemes
A blind signature scheme is an interactive protocol between a signer $\mathsf{S}$ (holding a secret key $sk$) and a user $\mathsf{U}$ (holding a public key $pk$ and a message $m$) with the goal that $\...
- 74
1
vote
What is blindness and forgeability in Chaum's blind signature scheme?
Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined.
In ...
1
vote
What is blindness and forgeability in Chaum's blind signature scheme?
It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{...
- 209
1
vote
Are (EC) DSA blind signatures possible?
The below paper gives one;
2021, One-more Unforgeability of Blind ECDSA by Xianrui Qin and Cailing Cai and Tsz Hon Yuen
- 717
1
vote
Is this schema secure?
Blind signature works as follows:
(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $
(2) the signer will blindly sign the value by ...
- 452
1
vote
Usability of padding scheme in blinded RSA signature?
Answer by DrLecter looks incorrect. Afaik almost all RSA padding schemes have been deprecated. I believe unblinded RSA would use PSS padding today, but as I explained in https://crypto.stackexchange....
- 1,104
1
vote
Accepted
RSA-blind signatures vs. DSA-blind signatures
Well, I think it is quite hard to give a really objective and complete answer to this question.
Personally, I think that why you may encounter RSA blind signatures quite often is due to it's ...
- 12.1k
1
vote
How does Schnorr signature actually work?
Signatures do not keep the message secret.
Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$.
...
- 314
Only top scored, non community-wiki answers of a minimum length are eligible