2009-04-03, 01:29 PM
Stereo Wrote:What if Gregory abuses his position of creating the "blinding" method to set it up in such a way that "unblinding" will always return the amount of money he wants it to.
Like you say unblind(p_x, 200) and it turns out it is a money order for $200
Or you say unblind(p_z, 200) and it is also a money order for $200
And then at step 5, when he "unblinds" for the merchant, he just marks it up however much is necessary.
Ahh, but how "blinding" documents work is that the process is done in such a way that it has a mathematical relationship with the bank's digital signature (the bank must know what "blinding" protocol was used), so that in the process of "unblinding" the document, you preserve the signature. For the most basic "blinding" procedure, you just multiply the document by some random number, rendering it unreadable, but make sure the random number has a commutative property with the bank's signature or else it doesn't work. But something important to remember is that, while Gregory and the bank knows how "blinding" is done between them, the bank doesn't know how to "unblind" Gregory's document because the process requires you to know the "blinding factor", or the key.
Now, the bank would be smart enough to sign with a secure signature scheme that's compatible with a "blinding" protocol that is also secure. Given all this, it'd be extremely hard to find another document, let alone a valid money order, that also has a mathematical relationship that's congruent to the original document.