Skip to content

Blind signatures

The signer signs a message it can't see, and can't later match the signature to the request. Chaum's idea for digital cash, now used for anonymous tokens on the web.

Status and standards: see Digital signatures in the main table.

What it is

David Chaum proposed blind signatures at CRYPTO '82 for "untraceable payments". The bank signs your coin without seeing its serial number and takes a dollar from your account. When a shop deposits the coin, the bank checks its signature and refuses serials it has seen before, but can't tell whose withdrawal the coin came from.

A scheme needs two things:

  • Blindness: the signer can't link a finished signature to the session that made it.
  • One-more unforgeability: n signing sessions give the client at most n valid signatures.

RFC 9474 (October 2023, from the IRTF's CFRG) specifies the RSA version. The result is an ordinary RSASSA-PSS signature, so any RSA-PSS verifier can check it.

How it works

The signer has an RSA key: public (n, e), secret d.

  1. Blind (client): encode the message as a number m (RFC 9474 uses PSS with SHA-384), pick a random r and send m′ = m·rᵉ mod n. With r random, m′ says nothing about m.
  2. BlindSign (signer): return s′ = m′ᵈ mod n, after checking s′ᵉ = m′ to catch faults.
  3. Finalize (client): s = s′·r⁻¹ mod n. Since (m·rᵉ)ᵈ = mᵈ·r, this is mᵈ, the plain RSA signature on m. Verify it before use.

Of RFC 9474's four variants, it advises the Randomized ones: they put 32 random bytes in front of the message, which protects clients from a malicious signer. The Deterministic ones are for messages already random enough.

When to use it

  • Privacy Pass (RFC 9576 to 9578, 2024): a client passes a check and gets a token for a website, which can verify it but can't link it to the check or to the client's other visits. Token type 2 is blind RSA with a 2048-bit key, checked with the issuer's public key; type 1 is a VOPRF that needs the issuer's private key.
  • Apple's Private Access Tokens (iOS 16 and macOS Ventura, 2022) are Privacy Pass tokens that replace CAPTCHAs. Apple checks the device and account, an issuer such as Cloudflare or Fastly signs the blinded token, and the site learns only that a genuine device passed. RFC 9474 also names iCloud Private Relay and Google One's VPN.
  • E-cash: Chaum's company DigiCash ran ecash with a few banks from 1995 until it went bankrupt in 1998. GNU Taler's exchange signs coins with RSA blind signatures today.

Example (Python)

A toy: a 150-bit key from two Mersenne primes, and a hash reduced mod n in place of PSS. Real keys are 2048 bits or more.

import hashlib, secrets

p, q = 2**61 - 1, 2**89 - 1                # toy key from two Mersenne primes
n, e = p * q, 65537
d = pow(e, -1, (p - 1) * (q - 1))          # the signer's secret

msg = b"token 7f3a"
m = int.from_bytes(hashlib.sha256(msg).digest(), "big") % n

r = secrets.randbelow(n - 2) + 2           # client: random blinding factor
blinded = m * pow(r, e, n) % n             # this is all the signer sees

blind_sig = pow(blinded, d, n)             # signer: plain RSA on the blinded value

s = blind_sig * pow(r, -1, n) % n          # client: divide r back out
print(pow(s, e, n) == m, s == pow(m, d, n))   # True True

The second True shows the client holds exactly mᵈ, though the signer only saw blinded.

Security notes

  • Use the key for nothing else. The signer raises any number it gets to d, so a key that also decrypts or signs anything else lets clients decrypt or sign whatever they like. RFC 9474 asks for one key per protocol and per variant.
  • The signer can't see what it signs, so it decides by who is asking (an account, rate limits, device attestation). Verifiers check the message has the expected form.
  • Everyone must get the same public key. A per-client key would identify the client later; Privacy Pass requires a consistency check (RFC 9576).
  • r must come from a secure random generator. A signer who can guess it can unblind the message.
  • Blind Schnorr looks simple, but an attacker running a few hundred sessions at once gets one signature more than it asked for (the ROS attack, Benhamouda and others, 2021). Fuchsbauer, Plouviez and Seurin (2020) gave a fix, which Taler offers as "Clause Blind Schnorr". Blind BLS (Boldyreva, 2003) takes one round but needs pairings.
  • A quantum computer running Shor's algorithm could forge tokens.

See also

  • RSA: the signature underneath
  • Schnorr: the signature behind blind Schnorr

References

Weaker sources: DigiCash's bank years from Wikipedia; Taler's Clause Blind Schnorr option from a Bern student thesis.