Blind Signatures: Getting Something Signed Without Letting the Signer See It

What a Blind Signature Actually Achieves

A digital signature normally certifies two things at once: that a specific authority approved a message, and what that message actually says, since the signer necessarily reads it before signing. A blind signature splits these apart. It lets a requester obtain a valid, verifiable signature from an authority on a message of their choosing, while the authority never learns the message's content and, crucially, can never later connect the signature it produced to the specific request that generated it. The signature that comes out the other end is completely ordinary: anyone can verify it against the signer's public key, and it proves the authority did indeed sign this exact message. What is missing is any record, on the signer's side, linking that output back to a particular transaction, requester, or moment in time. This is not the same as encryption hiding a message from everyone; the signer here is an active, willing participant who authorizes something despite never seeing it. The technique matters because so many real systems need an authority to certify eligibility or value without needing to certify or observe the details, and blind signatures let that authorization happen without creating a paper trail an authority could later exploit to track its users.

The Carbon-Paper Envelope: A Physical Analogy

The classic way to build intuition for blind signatures is entirely physical, and it predates any computer. Picture a sheet of paper on which you have written something private, slipped inside a special envelope lined with carbon paper. You seal the envelope and hand it to a notary. The notary cannot open the envelope or read what is inside, but they can sign the outside of it with a pen. Because of the carbon-paper lining, the pressure of that signature presses straight through the envelope and onto the hidden paper beneath, leaving a genuine signature mark on your private document, even though the notary never saw a word of it. You take the envelope back, tear it open, and remove your paper. It now carries a real, physically transferred signature that will hold up to scrutiny, yet the notary has no idea what they signed and, if you used a fresh unmarked envelope, no way to recognize this paper later even if they wanted to. This is exactly the shape of the cryptographic protocol: a disguise (the envelope) is applied before signing, the signature passes through the disguise onto the real content, and removing the disguise afterward reveals a valid signature on the original, never-seen message.

The RSA Mechanism: Multiplying in a Blinding Factor

RSA blind signatures turn the envelope trick into arithmetic using a beautifully simple property of modular exponentiation. The requester first picks a random blinding factor, then disguises their message by multiplying it by that blinding factor raised to the signer's public exponent, all reduced modulo the signer's public modulus. The result is a value that looks completely random and reveals nothing about the original message to anyone who does not already know the blinding factor. The requester sends this disguised value to the signer, who applies their private key exponent to it exactly as they would sign any ordinary message, having no way to distinguish it from random noise. When that signed, still-blinded value comes back, the requester divides out the blinding factor, specifically by multiplying by its modular inverse. Because RSA's signing operation is itself built from modular exponentiation, and because exponentiation distributes cleanly over multiplication under a common modulus, the blinding factor's own signature-like transformation cancels out perfectly, leaving behind exactly the signature that would have resulted from signing the original, unblinded message directly. No approximation, no residue, no trace, just a mathematically exact valid signature on content the signer never touched.

Why This Delivers Genuine, Provable Anonymity

The privacy guarantee here is stronger than simply hiding information through obscurity; it is a structural property of the math. Because the blinding factor is chosen randomly and independently for every request, the disguised value the signer actually processes is statistically unlinkable to the final unblinded message and signature that the requester later uses. Even if the signer keeps a perfect log of every blinded value it ever signed, that log is useless for connecting a later-presented, valid signature back to any specific entry, because the relationship between the two is hidden behind a random multiplier only the requester ever knew. At the same time, nothing about the signature's validity is weakened. It is unforgeable in exactly the same sense as a normal RSA signature, verifiable by anyone using the signer's ordinary public key, and it proves authorization happened. This combination is what makes blind signatures valuable in situations dominated by conflicting demands: an authority must be able to say yes or no to a request, its approvals must be trustworthy and checkable, yet the people relying on that authority need assurance that approval cannot later be turned into a surveillance record.

Real-World Applications: Digital Cash and Anonymous Voting

David Chaum's original motivation in the 1980s was anonymous digital cash. In his scheme, a bank blind-signs a token representing a fixed amount of money, certifying that it is genuine and redeemable, without ever seeing which specific token it signed. When the token is later spent and deposited, the bank can verify the signature and honor its value, but has no way to connect that redemption to the withdrawal that created it, mimicking the anonymity of physical cash in a digital system. This same pattern reappears in some modern anonymous electronic voting schemes. An election authority needs to confirm that a given voter is registered and has not already voted, essentially blind-signing a token that certifies a ballot as valid and unique. The voter then casts that certified ballot through an anonymous channel, and anyone can verify the ballot carries a legitimate signature, while the authority that issued it cannot trace which certified token corresponds to which cast vote or how it was filled in. Beyond these two flagship uses, variants of blind signatures show up in privacy-preserving credential systems, anonymous authentication tokens, and other protocols where certified legitimacy and personal privacy would otherwise seem impossible to have at the same time.

Frequently asked questions

Try it live

Everything above runs in your browser — open Blind Signatures: Getting Something Signed Without Letting the Signer See It and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.