## 5 Security Analysis
### Resistance to Attacks  
The scheme is resistant to adaptive attacks due to the blinding of the message \(M\) before signing. In an adaptive attack, the attacker tries to manipulate the signatures based on information received from the signer. However, in the proposed scheme, the signer does not have access to the original message \(M\), but only to the blinded version \(M^{\prime}\), which limits the manipulation capability. Any modification of \(M^{\prime}\) by the attacker leads to invalid signatures, since \(\sigma^{\prime}\) directly depends on \(M^{\prime}\) and \(K_{priv}\), and the recipient can verify the signature using the public key \(K_{pub}\).  
Malleability attacks involve modifying a valid signature to obtain another valid signature without access to the private key. The proposed scheme prevents this type of attack due to the following properties:  
* The blinded signature \(\sigma^{\prime}\) depends on r: \[\sigma^{\prime}=(M\cdot r)^{K_{priv}}\ mod\ n.\] Any modification of \(r\) completely changes the value of \(\sigma^{\prime}\), invalidating the final signature \(\sigma\) after the blinding is removed.
* The reversibility of the blinding is exclusively controlled by the recipient: Only the recipient knows \(r\) and can reverse the blinding to obtain the final signature \(\sigma\). This makes it impossible for an attacker to manipulate \(\sigma^{\prime}\) without compromising the signature.  
Integrity is guaranteed by the verification process, which confirms that the signature \(\sigma\) corresponds to the original message \(M\). If the signature is modified or generated for another message \(M^{\prime}\), the verification fails, because the equation is not satisfied:  
\[\sigma^{e}\ mod\ n=M.\]  
Moreover, the parameter \(T\) provides additional control over the level of anonymity and integrity. For example, a high \(T\) protects additional data by including it in the validation equation, while a low \(T\) may reveal additional information for auditing.  
Security against brute-force attacks is ensured by using the parameter \(T\) and the factor \(r\), which contributes to increasing the cryptographic complexity of the scheme. The random choice of the value \(r\) considerably expands the search space for a potential attacker, reducing the chances that a brute-force attack will be effective. In addition, the use of large values for \(n\), such as \(n\geq 2048\) bits in the case of the RSA algorithm, increases the resistance to brute-force attacks, thus making the scheme extremely robust against this type of threat.  
The proposed scheme prevents man-in-the-middle attacks by using blinding and bidirectional cryptographic validation. In such an attack, an adversary intercepts the communication between the signer and the recipient, trying to modify the messages or generate their own signatures. However, the scheme provides protection through the following mechanisms:  
* Message blinding \(M\): The adversary cannot deduce the original message \(M\) from the blinded message \(M^{\prime}\), because the random factor \(r\) is known only to the recipient.
* Signature-message binding: The signature \(\sigma\) is generated so that it is valid only for \(M\) and \(K_{priv}\), and the adversary cannot generate valid signatures without the private key.
* Validation using \(K_{pub}\): Even if the adversary intercepts \(M\) and \(\sigma\), validation using the public key \(K_{pub}\) guarantees that only authentic signatures are accepted.