Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 18370 — Blind Digital Signatures Standard Series
Information technology — Security techniques — Blind digital signatures — Part 1 & Part 2
🖋️ BS ISO/IEC 18370 is the British Standards Institution (BSI) adoption of the ISO/IEC 18370 series, covering blind digital signatures as an information-security technique. A blind signature is a special type of digital signature in which the signer signs a message without knowing its content; the message holder later “unblinds” the signature to obtain a valid signature over the original message. It was prepared by UK technical committee IST/33/2 (Cryptography and Security Mechanisms) and carries ICS classification 35.040. The series currently comprises two parts: Part 1 specifies the general requirements and Part 2 specifies blind signature mechanisms based on discrete logarithms.
💡 The key value of blind signatures is “unlinkability”: the signer cannot link a given signing request to any subsequently appearing valid signature, which makes them essential in scenarios such as electronic voting and electronic cash that require anonymity plus third-party verifiability.
1. Series Overview and Positioning 📌
Blind digital signatures were first proposed by David Chaum for e-cash and anonymous voting. The basic flow is: the message holder first “blinds” the message, then submits it to the signer; the signer signs the blinded message; the holder “unblinds” the signature to obtain a valid signature over the original message. Because the signer never sees the original message, it cannot link a signature to a particular holder.
The two parts currently in the BS ISO/IEC 18370 series are shown below. Part 1 establishes the conceptual model, participating entities, and security requirements; Part 2 provides concrete mechanisms based on the discrete-logarithm problem.
| Standard | Subject | Key Content | Edition |
|---|---|---|---|
| BS ISO/IEC 18370-1:2016 | General | Blind signature concepts, participating entities, security requirements, and the general model | First edition 2016-11-15 |
| BS ISO/IEC 18370-2:2016 | Discrete logarithm based mechanisms | Blind signature mechanisms based on the discrete-logarithm problem and their implementation requirements | First edition 2016-07-01 |
⚠️ The fundamental difference from an ordinary digital signature is that “the signer does not know the message being signed”. If a system actually needs the signer to know the message content (e.g., ordinary document signing), a standard digital signature should be used instead of a blind signature.
2. Participating Entities and Security Model 🏗️
BS ISO/IEC 18370-1 defines the participating entities of a blind signature, mainly including:
- Signer: the entity that holds the private key and signs the blinded message.
- Message holder (requester / message owner): the entity that owns the message to be signed and performs blinding and unblinding.
- Verifier: the entity that verifies the validity of the signature using the signer’s public key.
The Standard also specifies the security properties of blind signatures, including blindness (the signer cannot learn the message content), unforgeability, and unlinkability, together with general requirements and the general model that serve as the basis for the subsequent mechanism implementations.
3. Discrete-Logarithm-Based Mechanisms 🔧
BS ISO/IEC 18370-2 specifies blind signature mechanisms based on the discrete-logarithm problem. These mechanisms rely on the hardness of the discrete-logarithm problem in a finite field or an elliptic-curve group, and common examples are blind variants of Schnorr-type and ElGamal-type signatures. The Standard specifies:
- Symbols and parameters: system parameters such as the group, generator, order, and hash function.
- Key generation: the generation flow for the signer’s public/private key pair.
- Blind-sign-unblind flow: the complete protocol steps of the blind signature.
- Verification and security: the signature verification equation and the security-attribute rationale.
💡 Discrete-logarithm-based blind signatures offer good efficiency and provable security, and are the mainstream direction for blind-signature standardisation and deployment; elliptic-curve versions can use shorter key lengths at the same security level.
4. Engineering Practice and Applications 🔍
Blind digital signatures are widely used in scenarios requiring “anonymous but verifiable” operations. Engineering practice points include:
- Electronic voting: the voter blinds the ballot and submits it to the election authority for signing, ensuring the ballot is anonymous and verifiable while preventing double voting.
- Electronic cash: the bank signs a blinded “coin”; after unblinding, the user can spend it anonymously while the bank prevents forgery and double spending.
- Parameter security: choose sufficiently large security parameters (group order, hash length) and consider the resistance of the underlying discrete-logarithm problem to quantum attacks.
- Implementation audit: blind signatures rely on random blinding factors; implementations must use a secure random number generator to avoid randomness flaws that could leak privacy.
5. Frequently Asked Questions ❓
❓ Q: What is the difference between a blind signature and an ordinary signature?
A: In an ordinary signature, the signer knows the message being signed; in a blind signature, the signer signs only the blinded message and cannot see the original message, so the signer cannot link the signature to the holder’s identity.
A: In an ordinary signature, the signer knows the message being signed; in a blind signature, the signer signs only the blinded message and cannot see the original message, so the signer cannot link the signature to the holder’s identity.
❓ Q: What security properties does a blind signature provide?
A: Mainly blindness (the signer does not know the message), unforgeability (a valid signature cannot be forged without the key), and unlinkability (the signer cannot map a signing request to a valid signature).
A: Mainly blindness (the signer does not know the message), unforgeability (a valid signature cannot be forged without the key), and unlinkability (the signer cannot map a signing request to a valid signature).
❓ Q: Why does Part 2 focus on “discrete logarithm”?
A: The discrete-logarithm problem is one of the most studied and reliably hard problems in cryptography; blind signature mechanisms based on it are provably secure and efficient, making it the mainstream choice for standardisation.
A: The discrete-logarithm problem is one of the most studied and reliably hard problems in cryptography; blind signature mechanisms based on it are provably secure and efficient, making it the mainstream choice for standardisation.
🔍 Q: How does a blind signature prevent double voting in e-voting?
A: The election authority signs each blinded ballot exactly once and verifies signature uniqueness after unblinding; because of blindness, the authority cannot correlate ballots with voters, thus achieving one-person-one-vote while preserving anonymity.
A: The election authority signs each blinded ballot exactly once and verifies signature uniqueness after unblinding; because of blindness, the authority cannot correlate ballots with voters, thus achieving one-person-one-vote while preserving anonymity.