8
Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing friendly elliptic curve groups.
This blind signature scheme can be based on the compact BLS-signature scheme (which is based on gap-DH groups, i.e., groups in which ...
6
How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign.
Assuming that the $r$ values are chosen uniformly from the values $[1, N-1]$ relatively prime to $N$ (and kept secret, for example, zeroized after use), and none of the $m$ values are relatively prime ...
6
As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works.
Remarks from the previous ...
6
Designing such signature schemes from scratch without having strong experience is very likely to fail and very dangerous (see the tons of bad papers out there being accepted to "dubious" conferences and journals).
Your proposed scheme
Your verification relation is to check if: $sP - Q + R \stackrel{?}{=} zP + mP$ where $Q$ is the public key of the signer ...
6
I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).
However I do not believe this is impossible. So let's try to do this for ECDSA:
We have a message $m$ whose hashed value $H(m)$ is converted into an integer $z$ which gets signed into the signature $(r,s)$ by the signer....
5
The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using RSA, where $(e, N)$ is $\mathcal{B}$'s public key and $d$ is it's private key, this may look like:
$\mathcal{A}$ computes $x = m*r^e \mod N$, where $r$ is a ...
4
This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you fix that by pretending any of it makes sense the whole thing is trivially breakable. Throw it away and forget the whole ordeal—except don't forget that the ‘...
4
In the blind RSA signature scheme the blinding of a message
$m$ (to be blindly signed) is multiplicative with value $r^e$, where
you ensure that $r$ is invertible modulo $N$.
So if the sender receives the signed blinded message back from the
signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv
m^d \pmod N$ which is a valid (textbook) RSA ...
4
You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$.
On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...
3
There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it doesn't matter if you have more than one signature for it.
Second thing is that, even there are two pairs for single $m$, given one of them it's hard to find ...
3
This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice problems.
But this isn't surprising, because lattice problems can be used for:
building post-quantum encryption schemes, key exchange, signatures, etc.
...
3
It's impossible:
Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
2
So let's first recall how blinded RSA works:
Select primes $p=11$ and $q=19$, calculate the modulus $n=pq=209$, choose a public exponent $e=7$. Now calculate the signature exponent $d\equiv e^{-1} \pmod{(p-1)(q-1)}$ ($d=103, (p-1)(q-1)=180$).
Now let's go to the message-dependant processing:
A message $M$ is represented as the integer $m=16$ which is ...
2
Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs involve the simulator responding to random oracle queries in a way that will necessarily make their signatures validate, which they can do because they have control ...
2
The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures:
Lets say we want to blindly sign distinct messages $m_1$ and $m_2$ with distinct randomness $r_1$ and $r_2$.
Now during the blind signing you produce the transcripts (I omit $\mod N$):
$m_1'=...
2
Till today, there is no known construction for this. The problem is that standard hash functions do not come with the necessary algebraic properties required for blinding and unblinding.
2
There are random oracle model security proofs for RSA-PSS and RSA-FDH. There are standards for RSA-PSS but it requires randomness from the signer and thus does not work for blind signatures. RSA-FDH works with blinding.
RSA-FDH might appear in some standard somewhere, but honestly "full domain hash" is kinda self explanatory to a cryptographer. As an FDH ...
2
lattice-based blind signature scheme: “Lattice-based Blind Signatures” (PDF)
MQ-based blind signature scheme: “A Practical Multivariate Blind Signature Scheme” (PDF)
code-based blind signature scheme: “A Step Towards QC Blind Signatures” (PDF)
2
Why is this a requirement?
Well, if $r$ has (say) $p$ as a factor, then it makes the unblinding step rather difficult.
The original $m$ has $N = pq$ possible, as does $m^d$; if $r$ is a multiple of $p$, then $mr^e$ has only $q$ possible values; if we pass it to the signer, it'll come back to us with a value $m'^d$ that also has only $q$ possible values. We ...
2
One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend more than you received).
Indeed they are stronger when compared to other types of assumptions (eg. DLOG).
However there have been proofs of security based on the ...
2
Is it possible to trace (Sx, x) to (Sb, b) if Signer and Tallier is the same person?
No (assuming that the blinding factor was chosen uniformly at random).
Here's how RSA blinding works: to sign a padding message $m$, Bob selects a random value $r$, and sends $r^e \cdot m \bmod n$ (where $e, n$ are from the public key). Then, the signer computes $(r^e \...
2
note: I am not a cryptographer
I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so grateful to be answered.
Sorry, but when I hear questions like this, it sounds like:
I am not a surgeon, but I want to perform some heart surgery. I've done a lot ...
1
Referring to Vadym Fedyukovych's answer:
Nullifier idea of ZCash could also help.
In this case, a proof is constructed with a nullifier, which is generated and kept by Alice, its hash is provided to Bob and Charlie, as a the Bob/Charlie's side of the authorization. If Alice wants to use this authorization, Alice must provide the nullifier to Bob and ...
1
The scheme that solves your problem is called Zero Knowledge Proof of Set Membership
ZKP for Set Memberships use Accumulators. Crypto++ library provides an implementation of the accumulator
1
The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of references to the literature on this subject.
1
Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined.
In case if you don't want to deep dive into the paper, then I give you hereby a high-level description of the corresponding games.
Unforgeability: in the ...
1
It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{N}$ so even if you have unlimited computational power you can't extract $m^d$ from looking at $r \cdot m^d$. Even if you factor $r \cdot m^d$ you won't know ...
1
Blind signature works as follows:
(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $
(2) the signer will blindly sign the value by raising it to its private key $d$, as $ \sigma'^d = b \cdot M^d $
(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\...
1
The below paper gives one;
2021, One-more Unforgeability of Blind ECDSA by Xianrui Qin and Cailing Cai and Tsz Hon Yuen
1
Well, I think it is quite hard to give a really objective and complete answer to this question.
Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure
if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite ...
Only top voted, non community-wiki answers of a minimum length are eligible