Round-Optimal Constant-Size Blind Signatures

Blind signatures schemes allow a user to obtain a signature on messages from a signer, ensuring blindness (the signer should not learn which messages he signed or in which order) and unforgeability (the user should not be able to produce more signatures than the number of times he interacted with the signer). For practical purposes, it is important that such schemes are round-optimal (one flow sent by the user and one by the signer) and constant-size (the amount of data sent during the interaction should not depend on the length of the message), which are two properties difficult to ensure together. In this paper, we propose the first blind signature scheme both round-optimal, constant-size, in the standard model (without any random oracle) and under a classical assumption (SXDH). Our construction follows the classical framework initially presented by Fischlin. As a side result, we first show how to use a special kind of structure-preserving signatures (where the signatures also are group elements) in order to construct the first constant-size signatures on randomizable ciphertexts, a notion presented a few years ago by Blazy et al. Our construction of blind signature then builds upon this primitive and consists of constant-size two-round communication. It can be instantiated under any k - MDDH assumption, requires to exchange 9 elements and leads to a final signature with 22 elements when relying on SXDH.