Glossary

Blind Signature

A blind signature lets a signer sign a message without seeing its content, enabling private digital cash systems like Chaumian ecash.

Key Takeaways

  • A blind signature is a cryptographic protocol where a signer signs a message without learning its contents. The requester "blinds" the message before sending it, then "unblinds" the resulting signature afterward to obtain a valid signature on the original message.
  • David Chaum invented blind signatures in 1983 to enable untraceable digital cash. They are the foundation of modern ecash systems like Fedimint and Cashu, where the mint cannot link token issuance to redemption.
  • Blind signatures provide strong privacy but introduce a tradeoff: the signer cannot audit what it signs, which means fungibility comes at the cost of transparency. Double-spending prevention requires separate mechanisms.

What Is a Blind Signature?

A blind signature is a form of digital signature where the message is disguised before the signer signs it. The signer produces a valid signature without ever seeing the original content. After signing, the requester removes the disguise (the "blinding factor") to reveal a standard signature that anyone can verify against the original message and the signer's public key.

The concept was introduced by cryptographer David Chaum in his 1983 paper "Blind Signatures for Untraceable Payments." Chaum recognized that digital payments had a fundamental privacy problem: unlike physical cash, electronic transactions create a trail linking payer to payee. Blind signatures solve this by letting a bank sign digital tokens without knowing who holds them.

The classic analogy is a carbon-paper envelope. You write a message on a slip of paper, seal it inside an envelope lined with carbon paper, and hand it to the signer. The signer signs the outside of the envelope, and their signature transfers through the carbon to the message inside. When you open the envelope, you have a signed message that the signer never saw.

How It Works

The most widely known blind signature scheme uses RSA cryptography. The protocol involves three steps: blinding, signing, and unblinding.

Step 1: Blinding

The requester takes the original message and multiplies it by a random value called the blinding factor. This blinding factor is mathematically entangled with the signer's public key so that when the signer signs the blinded message, the blinding can later be cleanly removed.

# RSA blind signature (simplified)
# Public key: (e, n)  Private key: d

# 1. Requester blinds the message
r = random_integer()           # blinding factor
m_blind = m * r^e mod n        # blinded message

# 2. Signer signs the blinded message
s_blind = m_blind^d mod n      # blinded signature

# 3. Requester unblinds
s = s_blind * r^(-1) mod n     # valid signature on m

Step 2: Signing

The signer receives the blinded message and signs it with their private key. Because the message has been transformed by the blinding factor, the signer learns nothing about the original content. The resulting blinded signature is returned to the requester.

Step 3: Unblinding

The requester removes the blinding factor from the signed message using the modular inverse of the random value chosen in step 1. The result is a valid signature on the original, unblinded message. Anyone can verify this signature using the signer's public key, but the signer cannot correlate it to the blinding session.

Why the Math Works

The key property is that RSA signing and the blinding operation are both modular exponentiations that commute. Signing the blinded message produces a result that, when the blinding factor is divided out, yields the same value as if the original message had been signed directly. The signer's signature is valid, but the signer never saw what was signed.

Blind Signatures in Digital Cash

Chaum's original application was untraceable electronic payments. The protocol works like this:

  1. A user generates a random serial number for a digital token and blinds it
  2. The user sends the blinded token to the bank (the mint) along with a withdrawal request
  3. The bank debits the user's account and signs the blinded token
  4. The user unblinds the signed token, producing a valid banknote with the bank's signature
  5. To spend the token, the user presents it to a merchant
  6. The merchant sends the token to the bank for verification and redemption

The bank can verify that it signed the token (the signature is valid), but it cannot determine which withdrawal produced this specific token. The blinding step broke the link between issuance and redemption. This is the core privacy guarantee: the bank knows it issued a token and that a token was redeemed, but it cannot connect the two events.

Chaum commercialized this concept in 1990 through DigiCash, which processed the first electronic cash payment in 1994. Although DigiCash went bankrupt in 1998, the cryptographic primitives Chaum developed became foundational to modern privacy-preserving payment systems.

Use Cases

Chaumian Ecash on Bitcoin

The most significant modern application of blind signatures is in ecash protocols built on Bitcoin. Both Fedimint and Cashu implement Chaumian blind signatures to issue privacy-preserving tokens backed by Bitcoin.

In these systems, a mint (or federation of mints) holds Bitcoin in reserve and issues ecash tokens using blind signatures. When a user deposits Bitcoin, they receive blindly signed tokens. When they spend or redeem tokens, the mint verifies the signature and checks for double spending by recording spent serial numbers, but it cannot determine who originally withdrew those tokens.

The result is cash-like privacy for digital payments: the mint knows the total supply but cannot trace individual transactions. For a deeper look at how these systems work, see the research article on ecash and Chaumian mints on Bitcoin.

Fedimint: Federated Blind Signatures

Fedimint extends the blind signature model by distributing the signing authority across a federation of guardians using threshold signatures. Instead of a single mint holding the private key, multiple guardians each hold a key share. A threshold of guardians must cooperate to produce a valid blind signature.

This reduces the custodial risk of a single-operator mint while preserving the privacy guarantees of blind signatures. For details on how federations work, see the Fedimint research article.

Cashu: Single-Operator Mints

Cashu implements Chaumian ecash with single-operator mints: simpler to deploy, easier to understand, but with all custodial risk concentrated in one party. Cashu uses a variant of blind signatures based on elliptic curve cryptography rather than RSA, offering smaller token sizes and faster computation.

Both Cashu and Fedimint integrate with the Lightning Network, enabling users to send and receive ecash tokens across mints via Lightning payments.

Voting and Credentials

Beyond digital cash, blind signatures enable anonymous credential systems and electronic voting. A certificate authority can sign a voter's ballot without seeing its contents, ensuring that votes are authenticated (only registered voters can vote) while remaining secret (no one, including the authority, can link a ballot to a voter).

Why It Matters

Blind signatures solve a problem that no amount of encryption alone can address: how to authenticate data without the authenticator learning what it authenticated. This property is essential for building payment systems where the issuer (a bank or mint) can verify legitimacy without surveilling users.

In the Bitcoin ecosystem, blind signatures enable a privacy layer that complements on-chain techniques like CoinJoin and silent payments. While on-chain privacy tools try to obscure the transaction graph on a public ledger, ecash systems built on blind signatures operate off-chain with privacy as a default rather than an add-on.

For more on how these privacy approaches compare, see the research on Bitcoin's privacy landscape.

Risks and Considerations

Privacy vs. Auditability

The core tradeoff of blind signatures is that the signer cannot see what it signs. In a digital cash system, this means the mint cannot audit individual transactions. If a bug inflates the token supply or an attacker forges tokens, the mint may not detect it until reserve discrepancies emerge. Transparency and privacy are fundamentally in tension.

Custodial Trust

Ecash systems using blind signatures require users to trust the mint (or federation) to hold reserves honestly and redeem tokens on demand. Unlike self-custodial Bitcoin wallets, ecash tokens are IOUs backed by the mint's reserves. If the mint disappears or becomes insolvent, users lose their funds.

Double-Spend Detection

Blind signatures alone do not prevent double spending. The mint must maintain a database of spent serial numbers and check every redemption against it. This means ecash transactions are online by default: the recipient must contact the mint to verify a token hasn't already been spent. Offline spending requires additional cryptographic mechanisms, such as Chaum's 1988 extension with Fiat and Naor, which reveals the identity of double spenders after the fact.

Key Compromise

If the mint's signing key is compromised, an attacker can forge unlimited tokens. Unlike a physical mint where counterfeiting requires specialized equipment, a compromised private key lets an attacker silently inflate the supply. Federated models like Fedimint mitigate this by distributing the key across multiple guardians, so compromising a single guardian is insufficient.

Quantum Vulnerability

RSA-based blind signature schemes are vulnerable to quantum attacks. A sufficiently powerful quantum computer running Shor's algorithm could factor the RSA modulus and forge signatures. Research into lattice-based and other post-quantum blind signature schemes is ongoing, though no widely deployed replacement exists yet.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.