Subject: [CFRG] New draft on Key Blinding for Signature Schemes

From: Christopher Wood <[email-masked]>
Date: Tue, 8 Mar 2022 09:19:24 -0800

Hi folks,

We just published a new draft entitled, "Key Blinding for Signature Schemes," with the following high-level objective:

>  This document describes extensions to existing signature schemes for
>  key blinding.  This functionality guarantees that a blinded public
>  key and all signatures produced using the blinded key pair are
>  unlinkable to the unblinded key pair.  Moreover, signatures produced
>  using blinded key pairs are indistinguishable from signatures
>  produced using unblinded key pairs.

You can find the source here:

   https://github.com/chris-wood/draft-dew-cfrg-signature-key-blinding

Key blinding has been in use for quite some time, notably in the context of Tor [1]. This draft specifies functionality using _private_ key blinds for EdDSA and ECDSA. Its intended purpose is for a variant of Privacy Pass, described in [2]. Note that there are some interesting connections to related-key attacks on signature schemes [3]. As such, security analysis for the extensions contained in this document is underway to ensure they're safe. 

We'd like time on the agenda in IETF 113 to present this work to CFRG. In particular, we'd like to know if this is something the RG is interested in adopting as a work item.

I'm happy to answer any questions about the draft between now and then. Otherwise, see you at IETF 113!

Best,
Chris

[1] https://www-users.cse.umn.edu/~hoppernj/basic-proof.pdf 
[2] https://datatracker.ietf.org/doc/draft-privacypass-rate-limit-tokens/
[3] https://doi.org/10.1007/978-3-319-30840-1_2