## 4 Blind Schnorr Signatures--Results and Discussion
### Countermeasures  
The simplest solution to the problem of a black-box device \(\mathcal{D}\) and \(\mathcal{S}\) corrupting the blind-signature scheme is to use a watchdog. The watchdog serves as a proxy between \(\mathcal{D}\) and \(\mathcal{S}\) that modifies exchanged messages in an oblivious manner. In a real-life scenario, the watchdog could be a trusted software client for a hardware signing device. In case an Auditor wants to implement it, they can force the signing protocol users to run all communication through their proxy. Figure 11: Linking a signature \((c^{\prime},s^{\prime})\) with a transcript \((R,c,s)\) in case of the algorithm based on the public key \(R_{0}\). \(\mathsf{Dec}_{\mathsf{0}}\) denotes EIGamal decryption with private key \(r_{0}\). Figure 10: Protocol for creating a linkable signature based on hidden public key \(R_{0}\), In lines 3 and 4, the operation encode maps the elements of the group to \(\mathbb{Z}_{q}\). The watchdog influences the communication between [PERSON] and [PERSON] using randomly chosen \(\alpha^{\prime}\) and \(\beta^{\prime}\) (see Figure 12):  
\[ \begin{array}{ll}\bullet&\text{instead of passing $R$, the watchdog delivers $R=R\cdot\mathsf{pk}_{S}g^{\beta^{\prime}}\cdot g^{\alpha^{\prime}}$;}\\ \bullet&\text{instead of passing $c$, the watchdog delivers $c=c+\beta^{\prime}\bmod q$;}\\ \bullet&\text{instead of passing $s$, the watchdog delivers $s=s+\alpha^{\prime}\bmod q$.} \end{array} \]  
Since the order \(q\) is a prime number, the elements \(R,c\) are randomized so that the result is uniformly distributed in the respective group. The third message \(s\) computed by \(\mathcal{S}\) is deterministic and must be adjusted by setting \(s=s+\alpha^{\prime}\bmod q\) to obtain a valid signature. For honest parties, the protocol is indistinguishable from the one without a watchdog. The effectiveness of the watchdog protection follows from the following property:  
**Theorem 1**. : _Consider invocations \(\Pi_{1}\), \(\Pi_{2}\) of blind Schnorr signature creation executed by \(\mathcal{S}\) with devices \(\mathcal{D}_{1}\), \(\mathcal{D}_{2}\) (where \(\mathcal{D}_{1}\) and \(\mathcal{D}_{2}\) might be the same). Let the messages seen by \(\mathcal{S}\) during the execution of \(\Pi_{1}\) be \(R_{1},c_{1},s_{1}\). Let \(R_{2},c_{2},s_{2}\) be the messages seen by \(\mathcal{D}_{2}\) during execution of \(\Pi_{2}\). Then, there is a valid execution of the signing procedure with a watchdog, where the messages exchanged are \(R_{1},c_{1},s_{1}\) from the point of view of \(\mathcal{S}\), and \(R_{2},c_{2},s_{2}\) from the point of view of \(\mathcal{D}_{2}\)._  
In other words, given a signature \((c^{\prime},s^{\prime})\) and the full history of interactions with the clients, the Signer \(\mathcal{S}\) cannot exclude any session for being the one where \((c^{\prime},s^{\prime})\) was created. This means that it is impossible to link an unblinded signature with the signing session using subliminal channels in the signing procedure. As we will see later, it does not mean that all attacks are stopped, as it is still possible to carry out a linking attack using a subliminal channel in the unblinded signature \(\sigma\). Proof. : We have to find \(\alpha^{\prime},\beta^{\prime}\) that \"couple\" both executions. First, let \(\beta^{\prime}=c_{1}-c_{2}\bmod q\). Then, we have to show that there is \(\alpha^{\prime}\) such that  
\[R_{2}=R_{1}\cdot\mathsf{pk}_{S}^{\beta^{\prime}}\cdot g^{\alpha^{\prime}}\]  
That is, we ask for \(\alpha^{\prime}\) such that  
\[g^{\alpha^{\prime}}=R_{2}/R_{1}\cdot\mathsf{pk}_{S}^{\beta^{\prime}}\.\]  
The value on the right-hand side is already fixed, and \(g\) is a group generator, so there is such \(\alpha^{\prime}\). Finally, we observe that in this case, we automatically have \(s_{2}=s_{1}+\alpha^{\prime}\bmod q\).