2

I'm not an expert on Chaumian blind signatures, so forgive me if the answer to this is obvious, but I'm wondering how the coordinator can prove to the participants that it's not doing what I asked in the question.

If it uses a different key for each blind signing, then couldn't it just try every key against the small set of returned unblinded outputs to determine which one it used, and thus match it up against the corresponding input?

This seems too obvious a flaw to be the case, so I'm wondering how this is avoided.

Thanks!

Improve this question

1 Answer 1

Reset to default
2

This kind of attack on blind signing is indeed possible and usually called a tagging attack. In order to address it clients should verify that a consistent signing key is used.

The simplest way to address this is to require that the input ownership proofs commit to this key, and to broadcast these proofs to all clients who verify them before submitting an unblinded signature. None of the implementations do this.

Using Tor (or something similar) it's possible to mitigate: obtain the key and the blind signature using separate requests with connection isolation, and ensure that they are unlinkable. In this case a corrupt server would have to correctly partition the requests which is difficult but it's hard to reason about the difficulty of doing a targetted attack.

In the Schnorr blind signature based version of Wasabi 1.x the round keys (one per denomination) are fetched and are not compared to those obtained in any previous responses before requesting a blind signature. Note that for this mitigation the fact that the blind signature requests are inherently linkable to a specific previous status request due to the way the R points are handled is not a problem, the key point is that the client only reveals the input after obtaining the server key.

In Whirlpool the public key is part of the response to input registration, so there is no opportunity for such mitigation.

Improve this answer
1
  • Thanks for the detailed answer! Another way to mitigate it might be to have the co-ordinator chosen at random from amongst the participants, though I guess this would potentially reduce availability... If you did this, you could also make the public key (for the blind signing) sharing part of the coordinator selection process.
    – River Satya
    Commented Oct 23, 2022 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.