What is the concept of a blind signature, in non-mathematical terms?
The signer knows they are placing a signature, but cannot see what they're signing — the document content is hidden from them, only revealed to the bearer afterward.
Two parties, two roles:
| Party | What they want |
|---|---|
| Bearer (e.g. voter, e-cash customer) | A document signed by an authority, but without the authority learning what's in the document |
| Signer (e.g. election authority, bank) | To sign only one document per authorised bearer, without learning the content |
The mental model:
Imagine a sealed envelope with carbon paper inside. The bearer prepares the document, slides it into the envelope with carbon paper on top, and hands the closed envelope to the signer. The signer signs the outside of the envelope. The carbon transfers the signature through to the document. The bearer takes the envelope home, opens it, and now has a document signed by the authority — even though the authority never saw the content.
Mathematical realisation (blind RSA): the bearer multiplies the document by a random blinding factor the signer can't undo, then divides the blinded signature by the same factor to recover an unblinded signature on the original.
Two key properties:
- Blindness: the signer cannot link a later-presented signature to which session produced it. Even if they keep logs of every signing, they can't pick out this signature came from session #4321.
- Unforgeability: despite blindness, the bearer cannot create a valid signature without going through the signer — exactly one signature per signing session.
Applications:
- E-voting (Phase 1: the voter gets a blinded ballot signed; Phase 2: they unblind and cast it anonymously).
- e-Cash (Chaum's original DigiCash — bank signs blinded coins, customer spends unblinded versions anonymously).
- Anonymous credentials (IRMA / Idemix / Privacy Pass) — show you're authorised without revealing who you are.
Tip: "Blind" is the cryptographer's word for "the signer can't see content." It's not about the document being obscure — it's about an actual mathematical property preventing the signer from learning the content even with unlimited computational power on a specific run.