## 3 Methods
### Blind Signatures  
A blind-signature scheme enables a User \(\mathcal{U}\) to obtain digital signatures of a Signer \(\mathcal{S}\) for arbitrarily chosen messages. The key feature of a blind-signature scheme is that \(\mathcal{S}\) not only does not see the signatures created in interaction with the User but also cannot determine which message has been signed for whom if all these signatures are presented to \(\mathcal{S}\). In more detail, there are the following roles in the protocol:  
* Signer \(\mathcal{S}\) is a party that holds private signing keys and signs (blindly) messages on request of Users,
* User \(\mathcal{U}\) is a party that requests signatures of \(\mathcal{S}\) over chosen messages; all cryptographic operations of the scheme are executed by a black-box device \(\mathcal{D}\) of \(\mathcal{U}\) (we assume that \(\mathcal{D}\) may have a pair of keys \(\mathsf{sk}_{\mathcal{D}}\in\mathbb{Z}_{q}^{*},\mathsf{pk}_{\mathcal{D}}=g^{ \mathsf{sk}_{\mathcal{D}}}\) used, e.g., for authentication);A verifier \(\mathcal{V}\) checks the signatures allegedly created by \(\mathcal{S}\). A practical use case of a blind-signature scheme according to our model can be seen on Figure 1 (User login), Figure 2 (blind-signature creation) and Figure 3 (signature verification). Sometimes, the Signer and the Verifier are the same party, as the Signer can apply the verification procedure to signatures that appear on the market. Note that, in practice, \(\mathcal{U}\) stands also for some electronic devices, but, in contrast to \(\mathcal{D}\), it can be controlled (at least to some extent) by its owner-- a physical person. A blind-signature scheme consists of three procedures:  
Figure 1: User authentication before the creation of a blind signature. Figure 3: Signature verification. Figure 2: Blind signing process. **Definition 1**. : _(Blind-Signature Scheme). A blind-signature scheme \(\Pi\) is a tuple of algorithms \(\Pi=(\mathsf{Gen},\langle\mathsf{SignS},\mathsf{SignU}\rangle,\mathsf{Verify})\), where:_  
1. _The_ _key-generation procedure___\(\mathsf{Gen}(1^{n})\)_ _takes as input the security parameter_ \(n\) _and outputs a pair of signing keys_ \((\mathsf{sk},\mathsf{pk})\) _for the_ _Signer_ \(\mathcal{S}\)_._
2. _The_ _signing procedure_ _is an interactive protocol, where_ \(\mathcal{S}\) _runs_ \(\mathsf{SignS}(\mathsf{sk})\)_, and_ \(\mathcal{D}\) _runs_ \(\mathsf{SignU}(\mathsf{pk},\mathsf{m})\) _on behalf of a User:_ \[(\bot,\sigma)\leftarrow\langle\mathsf{BSignS}(\mathsf{sk}),\mathsf{SignU}( \mathsf{pk},\mathsf{m})\rangle\] _For message_ \(\mathsf{m}\in\mathcal{M}\) _(_\(\mathcal{M}\) _is the set of possible messages to be signed), the joint execution outputs a signature_ \(\sigma\) _on the side of the User_ \(\mathcal{U}\)_. A transcript_ \(\mathcal{T}\) _of the interaction (all messages exchanged between_ \(\mathcal{S}\) _and_ \(\mathcal{D}\) _during joint execution) is visible to all parties (including, in particular, the User)._
3. _The_ _verification procedure___\(\mathsf{Verify}(\mathsf{pk},\mathsf{m},\sigma)\)_ _takes as input a public key_ \(\mathsf{pk}\)_, a message_ \(\mathsf{m}\)_, and a signature_ \(\sigma\)_. It returns a bit_ \(b\in\{0,1\}\)_, where_ \(1\) _stands for 'the signature is valid'._  
_For_ _correctness_, we require that for any keypair_ \((\mathsf{sk},\mathsf{pk})\) _generated by_ \(\mathsf{Gen}\) _and a message_ \(\mathsf{m}\in\mathcal{M}\)_:_  
\[\mathbf{if}\quad(\bot,\sigma)\leftarrow\langle\mathsf{SignS}(\mathsf{sk}), \mathsf{SignU}(\mathsf{pk},\mathsf{m})\rangle\rangle,\quad\mathbf{then}\quad \mathsf{Verify}(\mathsf{pk},\mathsf{m},\sigma)=1\;.\]  
Properties of Blind Signatures  
There are two fundamental security and privacy properties of blind signatures:  
* **One-more unforgeablity:** This property captures the unforgeability of signatures: no signature can be created without running the interactive procedure with \(\mathcal{S}\).