In many applications involving anonymity, it is desirable to allow a participant to sign a message without knowing what the message is. This is called a blind signature.

Blind signatures

Suppose Charlie wants Dianne to sign a message m, but does not want Dianne to know the contents of the message. This might seem like a strange thing -- why would Diane sign something without knowing what it is? But the concept has useful applications in situations involving anonymity, such as digital cash and electronic voting. The arrangement works like this:
The concept of blind signatures (and their implementation in RSA) was invented by David Chaum in 1982.

Implementation in RSA

Recap on plain RSA signatures

Euler's totient. Two numbers are "relative primes" if their only common factor is 1. The Euler's totient of a number n, written phi(n), is the number of relative primes to n which are less than n.  If n=57, all 56 of the numbers less than n are relatively prime to n, because n is prime. So phi(57)=56. Fact 1: if n is the composite pq, where p and q are prime, then phi(n) = (p-1)(q-1).  For example, suppose n=35. We can work out manually that there are 24 primes relative to 35 which are below 35, namely {1,2,3,4,6,8,9,11,12,13,16,17,18,19,22,23,24,26,27,29,31,32,33,34}. We can use the fact mentioned to calculate this more directly. Since 35 =  5*7, and 5 and 7 are primes,  phi(35)=4*6=24, as expected.
Modulo arithmetic. In "mod n" arithmetic, all numbers are reduced to their remainder on division by n. For example, we are used to working in "mod 256", where (for example) 250 + 10 = 4 (mod 256), and 100 * 4 = 144 (mod 256), and 1002 = 16, 1003=64, 1004=0 (mod 256).  Fact 2: aphi(n) = 1 (mod n).

Generating the public and private keys.
Exercise. Which of the following key pairs are valid?
  1. K=(3,99), K-1=(27,99)
  2. K=(7,187), K-1=(23,187)
  3. K=(23,187), K-1=(7,187)
  4. K=(7,143), K-1=(23,143)
Can you invert the key (7,147)?
Pick two large prime numbers, p and q. Let n=pq. Typically, n is a 1024 bit number. Pick e relatively prime to (p-1)(q-1). Now find d such that ed=1 mod (p-1)(q-1). You can use Euclid's algorithm to find this d. The pair of numbers (e, n) is the public key. The pair of numbers (d, n) is the private key. The two primes p,q are no longer needed, and can be discarded, but should never be revealed.

Message format. Divide the message into blocks, each block corresponding to a number less than n. For example, for binary data, the blocks will be (log2 n) bits.
Signing. The signature of message m is  s = md mod n.
Signature verification. To recover the message from the signature s,  put m' = se mod n.

Why it works.

(mod n)
by definition of sig verification

(mod n)
by definition of signature

mk(p-1)(q-1) + 1
(mod n)
since de = k(p-1)(q-1) + 1, some k

mk phi(n) + 1
(mod n)
Fact 1

(mphi(n) )k m  (mod n)
elementary equivalences

(mod n)
Fact 2

Exercise. Sign the message 88 with the key (7,187). (Details of similar calculation [1],p.468, [2],p.271.)

Blind signatures

Suppose C wants D to sign the message m blindly. Suppose D's public key is (e,n) and her private key is (d,n).

C first blinds the message m, by multiplying it by ke mod n, where k is a randomly chosen number called the blinding factor. C sends the blinded message m . ke mod n to D.
Next, D signs the blinded message, resulting in ( m . ke )d mod n, and sends the signed blinded message back to C.
Finally, C unblinds the message by dividing by k mod n, resulting in ( m . ke )d / k mod n.

( m . ke )d / k mod n
  md . ked  / k mod n (mod n)
elementary equivalence

md . k / k mod n (mod n)
by the reasoning given above

md mod n (mod n)
which is the D's signature on m

Implementation in other cryptographic schemes

Many other crypto schemes besides RSA also support blind signatures.


[1] Bruce Schneier, Applied Cryptography. Second Edition, J. Wiley and Sons, 1996.
[2] William Stallings, Cryptography and Network Security, Principles and Practice,  Prentice Hall, 1999.
[3] Nigel Smart, Cryptography. McGraw Hill, 2003.