Blind Schnorr Signatures
Interactive Demo
Disguise a Nostr event, ask the server to blindly sign, then unblind & post!
Schnorr signatures let a signer prove they signed a message using their secret key. Blind signatures take this a step further -- you can sign a message without ever knowing the contents of what you are signing.
A user disguises their message, has the server sign the disguised message, then unblinds the result -- producing a valid signature that the server can't link back to the message it signed.
This is powerful for privacy: a server can act as an authority while remaining blind to the contents of the data it is authorising. See this article by Nadav @ suredbits for more on the math.
Follow steps 1–7
1. Generate a nonce
The server has a private key \(x\) and public key \(X = x*G\).
(\(G\) is the generator point of an elliptic curve -- it is
impossible to find \(x\) from knowing \(X\)).
Server generates a random secret \(k\) and public nonce \(R=k*G\).
2. Choose a message
Choose a message for the server to blindly sign \(m\).
3. Generate blinding values
Generate two random scalar values \(\alpha\) and \(\beta\). These will be used to blind (disguise) what we request the server to sign.
Blinding values are generated locally in your browser using WASM.4. Apply blindings
Blind the nonce \(R' = R + \alpha*G + \beta*X\).
Create a challenge \(c = H(X, R', m)\) using hash function \(H\), then blind it \(c' = c + \beta\).
Uses WASM to locally blind the nonce and create a challenge.5. Sign blinded challenge
Request the server to produce a signature using nonce secret \(k\) and private key \(x\): \(s = k + c'*x\).
6. Unblind signature
Use the blinding values to get the tweaked signature \(s' = s + \alpha\).
Locally unblind the signature using WASM.7. Verify signature
Once the user shares the signature-nonce pair \((s', R')\), anyone can verify it solves the schnorr verification equation \(s' * G = R' + c*X\) for challenge \(c\) belonging to message \(m\).
Most importantly, the server has no way of correlating this signature-nonce pair with the challenge and nonce they signed with earlier.
Valid?:
Schnorr Verification Equation
Show \((s', R')\) solves the schnorr verification equation \((s' * G = R' + c*X)\) for challenge \(c\) under public key \(X\):
Hint: Expand \(s'\) from definitions (plug and chug the algebra)made with love by utxo.club