6 votes
Accepted

How secure is a blind signature?

How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign. Assuming that the $r$ values are chosen ...
user avatar
  • 134k
6 votes

Are (EC) DSA blind signatures possible?

I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant). However I do not believe this is impossible. So let's try to ...
user avatar
  • 7,266
5 votes
Accepted

Are Blind Signatures Fundamentally Different From Signatures of Hashed Values?

The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using ...
user avatar
  • 3,952
4 votes
Accepted

RSA Blind Signature Attack

You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$. On the other ...
user avatar
  • 134k
4 votes
Accepted

Is there a flaw in this ECC blind signature scheme?

This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you ...
user avatar
3 votes

Post-Quantum Blind Signatures?

This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice ...
user avatar
  • 12.3k
3 votes

Blind Hash Signatures?

It's impossible: Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
user avatar
  • 24.1k
3 votes
Accepted

Double spending on a given Blind Signature over ECC protocol

There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it ...
user avatar
2 votes
Accepted

Blind signatures security

Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs ...
user avatar
2 votes
Accepted

Anonymity problem after voting with blind signatures

The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures: Lets say we want to blindly sign ...
user avatar
  • 12.1k
2 votes

Unblind a RSA blinded signature

So let's first recall how blinded RSA works: Select primes $p=11$ and $q=19$, calculate the modulus $n=pq=209$, choose a public exponent $e=7$. Now calculate the signature exponent $d\equiv e^{-1} \...
user avatar
  • 44.7k
2 votes
Accepted

Post-Quantum Blind Signatures?

lattice-based blind signature scheme: “Lattice-based Blind Signatures” (PDF) MQ-based blind signature scheme: “A Practical Multivariate Blind Signature Scheme” (PDF) code-based blind signature scheme: ...
user avatar
  • 1,370
2 votes

Blind Hash Signatures?

Till today, there is no known construction for this. The problem is that standard hash functions do not come with the necessary algebraic properties required for blinding and unblinding.
user avatar
  • 2,870
2 votes

Is there a standard padding/format for RSA Blind Signatures?

There are random oracle model security proofs for RSA-PSS and RSA-FDH. There are standards for RSA-PSS but it requires randomness from the signer and thus does not work for blind signatures. RSA-FDH ...
user avatar
  • 1,104
2 votes
Accepted

Why blinding integer $r$ needs to be co-prime with $N$ in blind RSA signature

Why is this a requirement? Well, if $r$ has (say) $p$ as a factor, then it makes the unblinding step rather difficult. The original $m$ has $N = pq$ possible, as does $m^d$; if $r$ is a multiple of $...
user avatar
  • 134k
2 votes

Is it necessary to prove EUF-CMA security of blind signature based on one-more type assumption?

One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend ...
user avatar
2 votes
Accepted

RSA Blind Signatures Secure Implementation

note: I am not a cryptographer I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so ...
user avatar
  • 134k
2 votes
Accepted

Is it possible to de-anonymize user in RSA blind singing without knowing the random blinding factor only?

Is it possible to trace (Sx, x) to (Sb, b) if Signer and Tallier is the same person? No (assuming that the blinding factor was chosen uniformly at random). Here's how RSA blinding works: to sign a ...
user avatar
  • 134k
1 vote
Accepted

Is there a blind signature that can sign on a commitment?

In this paper, the blind signature generates a commitment of the signature and a proof of the validity of this committed signature, then you can check the validity without opening the commitment by ...
user avatar
  • 2,191
1 vote

How can I prove "single-use authorization" from multiple parties without revealing identity?

Referring to Vadym Fedyukovych's answer: Nullifier idea of ZCash could also help. In this case, a proof is constructed with a nullifier, which is generated and kept by Alice, its hash is provided to ...
user avatar
  • 334
1 vote

How to prove that I am part of a list without revealing my identity?

The scheme that solves your problem is called Zero Knowledge Proof of Set Membership ZKP for Set Memberships use Accumulators. Crypto++ library provides an implementation of the accumulator
user avatar
1 vote
Accepted

How to achieve identity authentication without revealing credentials

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of ...
user avatar
1 vote

Regarding security of blind signature schemes

A blind signature scheme is an interactive protocol between a signer $\mathsf{S}$ (holding a secret key $sk$) and a user $\mathsf{U}$ (holding a public key $pk$ and a message $m$) with the goal that $\...
user avatar
  • 74
1 vote

What is blindness and forgeability in Chaum's blind signature scheme?

Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined. In ...
user avatar
1 vote

What is blindness and forgeability in Chaum's blind signature scheme?

It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{...
user avatar
  • 209
1 vote

Are (EC) DSA blind signatures possible?

The below paper gives one; 2021, One-more Unforgeability of Blind ECDSA by Xianrui Qin and Cailing Cai and Tsz Hon Yuen
user avatar
  • 717
1 vote

Is this schema secure?

Blind signature works as follows: (1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $ (2) the signer will blindly sign the value by ...
user avatar
1 vote

Usability of padding scheme in blinded RSA signature?

Answer by DrLecter looks incorrect. Afaik almost all RSA padding schemes have been deprecated. I believe unblinded RSA would use PSS padding today, but as I explained in https://crypto.stackexchange....
user avatar
  • 1,104
1 vote
Accepted

RSA-blind signatures vs. DSA-blind signatures

Well, I think it is quite hard to give a really objective and complete answer to this question. Personally, I think that why you may encounter RSA blind signatures quite often is due to it's ...
user avatar
  • 12.1k
1 vote

How does Schnorr signature actually work?

Signatures do not keep the message secret. Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$. ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible