## 5 Tessaro-Zhu Blind Signatures--Results and Discussion
### Countermeasures  
Similarly as for the blind Schnorr signature scheme, a properly implemented watchdog can mask the values sent on the wire so that no subliminal channel in the signing procedure can be used for the linking attack. The watchdog is presented on Figure 15.  
Let us check that the output on the side of \(\mathcal{D}\) is a valid Tessaro-Zhu signature. The key point is to check that  
\[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]  
as the right-hand side expression replaces \(A^{\prime}\) under the hash during the verification procedure. Recall that  
\[A^{*} = g^{s^{\prime}_{1}}\cdot A^{\gamma^{*}}\cdot Y^{\gamma^{*}\gamma_{ 2}^{*}}\] \[A^{\prime} = g^{s^{\prime}_{1}}\cdot(A^{*})^{\gamma}\cdot(Y^{*})^{\gamma_{1} \gamma_{2}}\] \[= g^{s^{\prime}_{1}}\cdot(g^{s^{\prime}_{1}}\cdot A^{\gamma^{*}} \cdot Y^{*}\gamma_{2}^{*})^{\gamma}\cdot Y^{\gamma_{1}\gamma_{2}^{*}}\] \[= g^{s^{\prime}_{1}+s^{\prime}_{1}\gamma}\cdot A^{\gamma\gamma_{ 2}^{*}}\cdot Y^{\gamma_{1}\gamma_{2}^{*}\gamma_{2}^{*}+\gamma_{2}}\]  
On the other hand,  
\[g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime} = g^{s^{*}\gamma\gamma+\gamma_{1}}\cdot\mathsf{pk}_{\mathcal{S}}^ {-c^{\prime}\gamma_{1}\gamma}\] \[= g^{(s\gamma^{*}+s^{\prime}_{1})\gamma+\gamma_{1}}\cdot\mathsf{ pk}_{\mathcal{S}}^{-c^{\prime}\gamma_{1}\gamma}\] \[= g^{((s+c\cdot y\cdot\mathsf{sk}_{\mathcal{S}})\gamma^{*}+s^{ \prime}_{1})\gamma+\gamma_{1}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime} \gamma_{1}\gamma}\] \[= g^{s_{1}+s^{\prime}_{1}\gamma}\cdot A^{\gamma\gamma^{*}}\cdot \mathsf{pk}_{\mathcal{S}}^{s\gamma_{1}\gamma}\cdot\mathsf{pk}_{\mathcal{S}}^ {-c^{\prime}\gamma_{1}\gamma}\] \[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]0 \[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]1 \[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]2 \[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]3  
\[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]4 Tessaro–Zhu blind-signature creation procedure (BS1 from [19]) with a watchdog \(\langle\mathsf{SignS},\mathsf{Watch},\mathsf{SignU}\rangle\). \[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]5  
For the constructed watchdog, we can show a result similar to Theorem 1. Theorem 2: _Consider invocations \(\Pi_{1}\), \(\Pi_{2}\) of blind Tessaro-Zhu signature creation executed by \(\mathcal{S}\) with devices \(\mathcal{D}_{1}\), \(\mathcal{D}_{2}\) (where \(\mathcal{D}_{1}\) and \(\mathcal{D}_{2}\) might be the same). Let the messages seen by \(\mathcal{S}\) during the execution of \(\Pi_{1}\) be \(A_{1},Y_{1},c_{1},s_{1},y_{1}\). Let \(A_{2},Y_{2},c_{2},s_{2},y_{2}\) be the messages seen by \(\mathcal{D}_{2}\) during the execution of \(\Pi_{2}\). Then, there is a valid execution of the signing procedure with the watchdog, where the messages exchanged are \(A_{1},Y_{1},c_{1},s_{1},y_{1}\) from the point of view of \(\mathcal{S}\), and \(A_{2},Y_{2},c_{2},s_{2},y_{2}\) from the point of view of \(\mathcal{D}_{2}\)._  
Proof: We have to show that there are the blinding factors \(r_{1}^{*},r_{2}^{*},\gamma^{*}\) that can be used to \"couple\" both executions. Since, according to the protocol specification \(c^{*}=c+r_{2}^{*}\bmod q\), we immediately obtain the value for \(r_{2}^{*}=c_{1}-c_{2}\bmod q\). Similarly, since \(y^{*}=y\cdot\gamma^{*}\bmod q\), we set \(\gamma^{*}=y_{2}/y_{1}\bmod q\). The value \(r_{1}^{*}\) should satisfy the equality  
\[A^{\prime}=g^{s^{\prime}}\cdot\mathsf{pk}_{\mathcal{S}}^{-c^{\prime}}\cdot y ^{\prime}\]6  
In the above equality, all values are fixed apart from \(r_{1}^{*}\). As \(g\) is the group generator, there is a unique \(r_{1}^{*}<q\) such that \(g^{\tau_{1}^{*}}=A_{2}\cdot A_{1}^{-\gamma^{*}}\cdot(Y_{2})^{-\tau_{2}^{*}}\). So it remains to check that \(s_{2}=s_{1}\cdot\gamma^{*}+r_{1}^{*}\).