Blind signature

A blind signature is a form of digital signature in which the message is blinded before signing, so the signer learns nothing about the content. The protocol typically involves a sender who applies a blinding factor to the message, the signer who signs the blinded value, and the sender who unblinds the result to obtain a valid signature on the original message.¹

The most common implementation is the blind RSA signature, where the sender computes m' = m * r^e mod n (with r a random blinding factor) and the signer returns s' = (m')^d mod n. The sender then derives s = s' * r^-1 mod n, which is a valid RSA signature on m.²

Blind signatures must satisfy two main security properties: blindness and unforgeability. Blindness ensures that the signer cannot link a message-signature pair to a particular signing session, even if they later see the message and signature. Unforgeability ensures that no one can produce a valid signature without the signer's cooperation.³

These properties are formalized in the random oracle model and have been extended to stronger notions such as one-more unforgeability, which prevents an attacker from producing more signatures than the number of signing queries made. Various schemes, including blind Schnorr signatures and blind BLS signatures, offer different trade-offs in efficiency and security assumptions.⁴

The most prominent application is anonymous digital cash, as proposed by Chaum in his 1982 paper “Blind Signatures for Untraceable Payments.” In such systems, a bank signs a blinded token representing a coin; later, when the coin is spent, the bank cannot trace it back to the withdrawal, preserving user privacy.¹

Blind signatures are also used in electronic voting protocols to ensure ballot secrecy, and in privacy-preserving credential systems where users obtain certified attributes without revealing them to the issuer. More recently, they have been applied in blockchain-based privacy solutions and in the design of anonymous cryptocurrencies.⁵

Beyond the classic RSA scheme, blind signatures have been constructed from various number-theoretic assumptions, including discrete logarithms and pairings. A notable variant is the partially blind signature, where the signer and user share a common public information (e.g., an expiration date) while keeping the rest of the message private.⁶

Another lesser-known fact is that blind signatures are closely related to the concept of “oblivious transfer” and have been used in the design of secure multiparty computation protocols. Additionally, the first practical implementation of blind signatures was in the eCash system, which was later commercialized by DigiCash, a company founded by Chaum in 1990.⁷

Blinding factor

A random value used to hide the message from the signer.

Unforgeability

The property that prevents an attacker from creating valid signatures without the signer's private key.

Blindness

The property that ensures the signer cannot link a signed message to a specific signing session.