6
Designing such signature schemes from scratch without having strong experience is very likely to fail and very dangerous (see the tons of bad papers out there being accepted to "dubious" conferences and journals).
Your proposed scheme
Your verification relation is to check if: $sP - Q + R \stackrel{?}{=} zP + mP$ where $Q$ is the public key of the signer ...
6
As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works.
Remarks from the previous ...
6
How hard would it be for a signing party to link blind messages to later revealed un-blinded versions, by keeping a log of blinded messages that they sign.
Assuming that the $r$ values are chosen uniformly from the values $[1, N-1]$ relatively prime to $N$ (and kept secret, for example, zeroized after use), and none of the $m$ values are relatively prime ...
6
Conceptually comparable to Chaums RSA blind signature scheme, is another elegant two move blind signature scheme called the blind Gap-DH signature scheme, which can be instantiated with pairing friendly elliptic curve groups.
This blind signature scheme can be based on the compact BLS-signature scheme (which is based on gap-DH groups, i.e., groups in which ...
5
The idea behind a blind signature is that party $\mathcal{A}$ has a message $m$ that they want party $\mathcal{B}$ to sign, but they do not want party $\mathcal{B}$ to learn the value of $m$. Using RSA, where $(e, N)$ is $\mathcal{B}$'s public key and $d$ is it's private key, this may look like:
$\mathcal{A}$ computes $x = m*r^e \mod N$, where $r$ is a ...
5
I am not aware of any existing scheme allowing this easily (excepted for PureEdDSA maybe, but I wouldn't classify it as an ECDSA variant).
However I do not believe this is impossible. So let's try to do this for ECDSA:
We have a message $m$ whose hashed value $H(m)$ is converted into an integer $z$ which gets signed into the signature $(r,s)$ by the signer....
4
You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$.
On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...
4
You are wrong. The purpose is to prevent linking the signing operation with the verification operation.
For instance, suppose that I have to identify myself when I ask B to sign the thing (maybe B charges me to create a signature; for instance, when blind signatures are used for e-cash, B is the bank, and B charges money to sign anything, since validly-...
4
In the blind RSA signature scheme the blinding of a message
$m$ (to be blindly signed) is multiplicative with value $r^e$, where
you ensure that $r$ is invertible modulo $N$.
So if the sender receives the signed blinded message back from the
signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv
m^d \pmod N$ which is a valid (textbook) RSA ...
3
This is adressed for example in Lattice-based Blind Signatures by Markus Rückert, 2008. I only had a quick glance, and it seems there is a construction for building blind signatures based on lattice problems.
But this isn't surprising, because lattice problems can be used for:
building post-quantum encryption schemes, key exchange, signatures, etc.
...
3
It's impossible:
Impossibility of Blind Signatures From One-Way Permutations - Katz, Schroder, Yerukhimovich
3
There's no such problem because, even if you find other $(F,s)$ pair, you still have signature for the same message $m$. So if your message contains anything like transaction id or serial number, it doesn't matter if you have more than one signature for it.
Second thing is that, even there are two pairs for single $m$, given one of them it's hard to find ...
3
This paper—if I have guessed correctly through the broken link—is bogus. It fails to distinguish points on the curve from elements of the coordinate field and doesn't prove anything and even if you fix that by pretending any of it makes sense the whole thing is trivially breakable. Throw it away and forget the whole ordeal—except don't forget that the ‘...
answered May 16 '19 at 23:50
Squeamish Ossifrage
43.4k3 gold badges87 silver badges184 bronze badges
2
So let's first recall how blinded RSA works:
Select primes $p=11$ and $q=19$, calculate the modulus $n=pq=209$, choose a public exponent $e=7$. Now calculate the signature exponent $d\equiv e^{-1} \pmod{(p-1)(q-1)}$ ($d=103, (p-1)(q-1)=180$).
Now let's go to the message-dependant processing:
A message $M$ is represented as the integer $m=16$ which is ...
2
No, that is not correct. You appear to have a misconception about how RSA signatures work.
Here is how an RSA signature is generated:
You take your message $M$
You apply a padding function to create a value $m = pad(M)$
You then use the RSA private key to compute $m^d \bmod N$
Now, this last step isn't always done in the straight-forward manner. With ...
2
Without the secret key, the signer can only be simulated through creative use of the random oracle (which is the only thing meaningfully in control of the simulator). Traditional signature proofs involve the simulator responding to random oracle queries in a way that will necessarily make their signatures validate, which they can do because they have control ...
2
The problem is, that you are actually checking a tautology and this is no danger to deanonymization. Let me explain it to you with a simple example of 2 signatures:
Lets say we want to blindly sign distinct messages $m_1$ and $m_2$ with distinct randomness $r_1$ and $r_2$.
Now during the blind signing you produce the transcripts (I omit $\mod N$):
$m_1'=...
2
lattice-based blind signature scheme: “Lattice-based Blind Signatures” (PDF)
MQ-based blind signature scheme: “A Practical Multivariate Blind Signature Scheme” (PDF)
code-based blind signature scheme: “A Step Towards QC Blind Signatures” (PDF)
2
Till today, there is no known construction for this. The problem is that standard hash functions do not come with the necessary algebraic properties required for blinding and unblinding.
2
There are random oracle model security proofs for RSA-PSS and RSA-FDH. There are standards for RSA-PSS but it requires randomness from the signer and thus does not work for blind signatures. RSA-FDH works with blinding.
RSA-FDH might appear in some standard somewhere, but honestly "full domain hash" is kinda self explanatory to a cryptographer. As an FDH ...
2
One more type assumptions are a better fit for blind signature schemes since they fit their security model (e.g. receive valid but anonymous coins from a bank where you should not be able to spend more than you received).
Indeed they are stronger when compared to other types of assumptions (eg. DLOG).
However there have been proofs of security based on the ...
1
The scheme that solves your problem is called Zero Knowledge Proof of Set Membership
ZKP for Set Memberships use Accumulators. Crypto++ library provides an implementation of the accumulator
1
The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of references to the literature on this subject.
1
Why is this a requirement?
Well, if $r$ has (say) $p$ as a factor, then it makes the unblinding step rather difficult.
The original $m$ has $N = pq$ possible, as does $m^d$; if $r$ is a multiple of $p$, then $mr^e$ has only $q$ possible values; if we pass it to the signer, it'll come back to us with a value $m'^d$ that also has only $q$ possible values. We ...
1
Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined.
In case if you don't want to deep dive into the paper, then I give you hereby a high-level description of the corresponding games.
Unforgeability: in the ...
1
It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{N}$ so even if you have unlimited computational power you can't extract $m^d$ from looking at $r \cdot m^d$. Even if you factor $r \cdot m^d$ you won't know ...
1
Blind signature works as follows:
(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $
(2) the signer will blindly sign the value by raising it to its private key $d$, as $ \sigma'^d = b \cdot M^d $
(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\...
1
Well, I think it is quite hard to give a really objective and complete answer to this question.
Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure
if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite ...
1
Signatures do not keep the message secret.
Verification in Schnorr is by recovering $r=g^s*y^c \textrm{ mod } p$ and then checking that $c$ depends on $r$ in the right way; i.e., $c=H(r||M)$.
Efficiently generating an $s$, $c$ pair requires knowing the private key, so that raising to $s$ can cancel the $g^x$.
1
I could solve my question using the fundamental work of Eric Verheul: Self-Blindable Credential Certificates from the Weil Pairing.
What I didn't know was the basic principle of self-blinding. In its simplest form, a peer (sk: $x\in Z$, pk: $X=g_1^x\in G_1$) communicates with an authority (sk: $a\in Z$, pk: $A=g_2^a\in G_2$) to get a certificate for his pk. ...
Only top voted, non community-wiki answers of a minimum length are eligible
