Re: [CFRG] I-D Action: draft-irtf-cfrg-rsa-blind-signatures-02.txt

[Jeff Burdges <[e-mail]>]

I wonder if the underlying RSA scheme should be called roughly RSA-PDH or something, where PHD = partial domain hash, because the security does not come via the same argument as in PSS.

> On 30 Aug 2021, at 05:00, Chelsea Komlo <[e-mail]> wrote:
> Section 5.1.1
> 
> "The blinding factor r must be randomly chosen from a uniform distribution. This is typically done via rejection sampling."
> 
> Is this not implied by the function random_integer_uniform?

In principle yes, but their desire to use PSS as a “partial domain hash” worried some of us that people would reuse the PSS “hasher” for the blinding factor, which instantly breaks the anonymity.  We’ve enough cases in elliptic curves where being full domain does not mater, ala ECDSA, that people do fuck this up in blind RSA.  I suggested finding more specific language for this reason.  

Jeff