Re: [CFRG] I-D Action: draft-irtf-cfrg-rsa-blind-signatures-02.txt

[Watson Ladd <[e-mail]>]

Salute omnes,

I've taken a look at the draft. First I think  that the section on
randomized vs deterministic signatures is a bit confusing. The server
never sees the unblinded message, so it's not possible to use the salt
as a subliminal channel. The draft also says that applications using a
deterministic salt should take into account the security
considerations but doesn't say what the security considerations that
should be taken into account are.

In the section discussing related protocols one of the big advantages
of RSA over alternatives, namely verification speed, is given short
shrift.  In cases such as privacy pass where issuance is gated by an
expensive verification, but verification must be exposed, expensive
verification is a liability. RSA verification can be as small as three
multiprecision multiplications: very hard to do much better.

I have also not verified the test vectors.

Sincerely,
Watson




--
Astra mortemque praestare gradatim