[CFRG] BBS Blind Signature Generators

["Bellebaum, Thomas" <[e-mail]>]

Dear authors of draft-irtf-cfrg-bbs-blind-signatures,

I have a question about the generators used in the scheme.
I understand that Q_2 is required to make the pedersen commitment C hiding. What I do not understand is why the other blind generators (J_i) are chosen to be separate from the usual message generators (H_i).

Intuitively and as mentioned in section 6.1, this effectively reveals to a verifier which messages were disclosed to the signer beforehand. While the section points at the main BBS draft for some discussion, I believe the discussion in the main draft is too limited to cover the implications of this addition.
As an example, a signature over a credential might consider its structure public, so that the total number of signed messages and mapping of indices to credential keys is considered public (this I understand is discussed in the main document).
However, assume that some provers are now forced to reveal certain messages to the signer, while others are not (A contrived example: A notorious tax evader is forced to temporarily reveal their blindly issued coins to their bank). The problem here is that every verifier can now see which provers were forced to do so.

It also makes the draft more complicated IMHO, because you have to generate two sets of generators with different api_id's. And it prevents easily moving from non-blind signatures to blind signatures.

In case the disclosure was intentional in some cases, note that trust in the signer implies that the signer can just have a public policy over which messages they allow/require to be revealed to them. Alternatively, one can encode this information as a message and disclose it to verifiers on demand.

Would it be possible to make the blind draft more similar to the main BBS draft, such that blind issuance becomes a simple extension of the capabilities of the main scheme?
This would entail one or more of the following:

1. Rather than having two sets of message generators (J_i and H_i), have the prover communicate to the signer which indices it intends to keep secret and split the H_i generators according to this information. The commitment C and associated linear proof should be calculated over the exponents of Q_2 and the H_i corresponding to undisclosed indices.
2. Allow non-blindly signed credentials to used with the blind proving interface by setting secret_prover_blind=0 for such credentials (which need not even be disclosed). Then, in the main draft, designate a generator as Q_2 with exponent 0 (or any fixed value) unless the blind-draft is used (just so that it appears as part of the domain calculation). This way, you could move almost all discussion about the proving mechanism to the main document, apart from one sentence to never disclose secret_prover_blind when using the normal proving mechanism (which is irrelevant for the main scheme).

Best,

-- TBB