Blind signatures have been shown to have many applications to anonymity and privacy concerns, from the seminal work of Chaum. In particular, many extensions have been developed for electronic cash systems.

 

Anonymity for e-cash indeed requires a kind of anonymous credential: a random coin, unlinkable to the user, but certified by the bank. However, most of previous schemes were either secure under strong assumptions(such as the One-More RSA intractability assumption for the original blind RSA signature) or highly interactive.

 

Recently a new approach has been proposed by Fischlin, based on proofs on committed values, but the resulting signature is quite large.

 

In this talk, we first present a new primitive, a randomizable signature on encrypted values with commutative encryption and signature schemes. We then show an efficient instantiation with Waters signature and Linear encryption, and thus

under classical assumptions. Eventually, we explain how to use it for two-flow blind signatures. It even leads to a fair blind signature scheme at no additional cost, and the resulting signature is the classical Waters signature.

Joint work with Olivier Blazy, Georg Fuchsbauer, and Damien Vergnaud