Re: [CFRG] I-D Action: draft-irtf-cfrg-rsa-blind-signatures-06.txt

Chris asked me to look at this document.

Overall, this looks good.  I had a few editorial issues, which I've opened issues or pull requests for.  However, I found an editorial issue that is worth raising here:
  https://github.com/cfrg/draft-irtf-cfrg-blind-signatures/issues/148

Sections 5 and 6 introduce message randomness requirements that don't seem to be very well contextualized.  I think that this stems from some unstated assumptions about the application domain.  Being a little more deliberate about how this scheme might be applied could go some way to making this sudden addition of a random suffix on messages understandable.

One consequence of this is that you might think, from reading up to Section 4, that you could send a message with an RSASSA-PSS label attached to it and the recipient doesn't need to care that it was generated using this process.  However, it is not clear to me now whether that would be a sensible thing to do, due to the entropy requirements imposed by the attacks referenced in Section 8.3.  Of course, adding 32 bytes of randomness to messages - the recommended approach - means that the recipient really does need to know that this has happened, or it might question what those 32 bytes mean.

On Wed, Nov 23, 2022, at 14:10, Richard Barnes wrote:
> Thanks, authors.  I reviewed this version, and it addresses my RGLC comments. 
>
> On Mon, Nov 21, 2022 at 17:15 <internet-drafts@ietf.org> wrote:
>> 
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the Crypto Forum RG of the IRTF.
>> 
>>         Title           : RSA Blind Signatures
>>         Authors         : Frank Denis
>>                           Frederic Jacobs
>>                           Christopher A. Wood
>>   Filename        : draft-irtf-cfrg-rsa-blind-signatures-06.txt
>>   Pages           : 31
>>   Date            : 2022-11-21
>> 
>> Abstract:
>>    This document specifies an RSA-based blind signature protocol.  RSA
>>    blind signatures were first introduced by Chaum for untraceable
>>    payments [Chaum83].  It extends RSA-PSS encoding specified in
>>    [RFC8017] to enable blind signature support.
>> 
>> Discussion Venues
>> 
>>    This note is to be removed before publishing as an RFC.
>> 
>>    Source for this draft and an issue tracker can be found at
>>    https://github.com/chris-wood/draft-wood-cfrg-blind-signatures.
>> 
>> 
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-rsa-blind-signatures/
>> 
>> There is also an HTML version available at:
>> https://www.ietf.org/archive/id/draft-irtf-cfrg-rsa-blind-signatures-06.html
>> 
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-rsa-blind-signatures-06
>> 
>> 
>> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
>> 
>> 
>> _______________________________________________
>> CFRG mailing list
>> CFRG@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg