My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed.

How is this different from simply appending a random salt to the message and hashing it? Wouldn't feeding that hash to the input of the RSA signing function accomplish the same thing?

Whoever knows the message, the salt and the signer's public key can then verify the signature. Or, whoever has the hash and the signer's public key can verify the signature. Meanwhile, the signer only knows the hash of what they are about to sign, so it seems that it accomplishes the same task - the signer is unaware of the contents of the actual message, and cannot link the signed hash to the original message without knowing the original message.

What is the rationale behind introducing blind RSA signatures, rather than using the method described above?

Is there some property that even after the original message is revealed to an attacker, it still cannot be linked to the signed message? Is that unlinkability?

1 Answer 1


Yes. Unlinkability is one of the Security goal that needs to be achieved.

For that, First hash of the message is performed and then add some randomness then give it to signer for signing. So that, Even after you send a signature and message, hash of the message would be easily computed by receiving party, he will not be able to collude with signer to know sender's identity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .