RSA blind signature vs signing a hash

Question

My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed.

How is this different from simply hashing some data and feeding that hash to the input of the RSA signing function?

Since the signer only knows the hash of what they are about to sign, it accomplishes the same task - the signer is unaware of the contents of the actual message.

What is the rationale behind introducing blind RSA signatures, rather than using the method described above?

Answer 1

According to the Wikipedia article for Blind Signatures:

Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be called upon to verify.

The principle of unlinkability exists (among other reasons) to protect the anonymity of the message's author. Imagine that 4 people each give a blinded message to the signer, which the signer provides signatures for. At some later date one of the messages is revealed. The signature should prove that A) the message is un-altered (integrity), and B) it is one of the original 4 messages (authenticity), but it should not be able to tell which of the original 4 it is (anonymity).

If you used "signing a hash" as a form of Blind Signature, then the signer (or an attacker recording their network traffic) could remember which hash came from which person, and then once the full message is revealed, you can compute its hash, compare it to the hashes that were submitted, and know which author wrote it, thus de-anonymizing the author.

Some applications or use-cases may not care about unlinkability, in which case signing a hash is a fine way to do a Blind Signature. But if you do, then this scheme is no good. For example, Blind Signatures are commonly used in election systems in which the inability to trace a revealed ballot back to the person who cast it is a requirement of the system.

Answer 2

Apart from the unlinkability property explained by @Mike (and it is very important in some contexts, e.g. in some voting protocols), simply providing a hash to the signer allows for an exhaustive search on the data -- while keys live in spaces big enough to thwart exhaustive search, meaningful data is not necessarily as resilient. E.g., if the data to be signed is either "yes" or "no", then there are only two possible hash values, and the signer can simply try both to see which one matches the hash value that he was sent.

If you want the signer not to be able to guess what he is signing, you should at least employ a randomized hash (the hashed data must include sufficiently many random bytes to prevent any guessing attempt by the signer).