Protocol Specification

Protocol Specification

Overview

Implementation of Chaum's blind signature protocol (CRYPTO '82) with RSA-3072.

Cryptographic Parameters

Parameter	Value	Security Level
RSA Modulus	3072 bits	128-bit
Public Exponent	65537	Standard
Hash Function	SHA-256	128-bit
CSPRNG	OS-provided	-

Withdrawal Protocol

Phase 1: Blinding

Client generates token:

serial = random(256 bits)
message = SHA256(serial)
blinding_factor = random() mod n
blinded_message = message × (blinding_factor^e) mod n

Phase 2: Signing

Server signs blinded message:

blind_signature = blinded_message^d mod n

Phase 3: Unblinding

Client unblinds signature:

signature = blind_signature × (blinding_factor^-1) mod n

Redemption Protocol

Verification

Server verifies token:

message = SHA256(serial)
recovered = signature^e mod n
valid = (message == recovered)

Double-Spend Check

1. Redis: EXISTS serial (O(1) check)
2. PostgreSQL: SELECT serial FROM redeemed_tokens
3. Both must return false

Recording

Atomic transaction:

BEGIN;
INSERT INTO redeemed_tokens (serial, ...) VALUES (...);
-- Redis: SET serial 1
COMMIT;

Security Properties

Unlinkability

Server cannot link withdrawal to redemption:

• Blinding factor unknown to server
• Statistical independence of blinded and unblinded signatures

Unforgeability

Cannot create valid token without server signature:

• RSA signature scheme security
• 3072-bit modulus provides 128-bit security

Double-Spend Prevention

Guaranteed by atomic operations:

• Redis provides fast duplicate detection
• PostgreSQL ensures persistence
• Both checked before acceptance