---
title: Lattice-Based Blind Signatures
url: https://www.emergentmind.com/topics/lattice-based-blind-signatures
type: topic
---

# Lattice-Based Blind Signatures

Lattice-based blind signatures are blind signature schemes whose security is grounded in lattice problems such as SIS, LWE, and their module or ring variants. They let a user obtain a signature on a message without revealing the message to the signer, while targeting post-quantum security for applications including electronic cash, electronic voting, and anonymous credentials. The area includes Schnorr-like interactive protocols with rejection sampling, GPV-style trapdoor-sampling designs, round-optimal two-move constructions using lattice NIZKs, and forward-secure schemes with time-evolving secret keys based on binary trees and trapdoor delegation [2509.02189] [2007.06884].

## 1. Historical setting and problem formulation

Blind signatures were introduced by Chaum in 1983 for untraceable payments and were quickly connected to e-cash and e-voting. In the classical RSA setting, the user blinds a message multiplicatively, the signer signs the blinded value, and the user unblinds the result; correctness follows because $ed \equiv 1 \bmod \varphi(n)$. This model established the basic privacy objective: the signer should not be able to link its interaction transcript to the final signed message [2509.02189].

Lattice-based blind signatures retain the same functional objective but replace RSA- or discrete-logarithm-based hardness with lattice assumptions. The motivation is explicitly post-quantum: RSA and discrete-logarithm based blind signatures are vulnerable to Shor’s algorithm, whereas lattice-based cryptography is a leading post-quantum candidate with worst-case-to-average-case reductions and practical signature instantiations such as CRYSTALS-Dilithium and FALCON [2509.02189].

The literature distinguishes between merely obtaining blindness and simultaneously addressing stronger deployment concerns. One such concern is key exposure. In the forward-secure setting, time is partitioned into periods, and disclosure of the current secret key should not compromise signatures from past periods. This requirement is particularly relevant because secret key exposure totally breaks ordinary digital signatures, whereas forward-secure signatures introduce a key-evolution mechanism that irrecoverably discards past signing capability [2007.06884].

A recurring misconception is that “lattice-based blind signatures” denotes a single protocol family. The surveyed literature instead spans several incompatible paradigms: GPV-type hash-and-sign systems with trapdoor sampling, Fiat–Shamir-with-aborts descendants using rejection sampling, Fischlin-style two-move designs with NIZKs, and forward-secure variants that add a time hierarchy on top of blind signing [2509.02189].

## 2. Security notions and adversarial models

The standard security triplet is correctness, blindness, and one-more unforgeability under adaptive chosen-message attacks. Correctness requires that if both parties follow the protocol, then $\mathrm{Verify}(pk,m,\pi)=1$ for the signature obtained via a correct blind-signing interaction. Blindness requires unlinkability between the signer’s view and the eventual message-signature pair. One-more unforgeability formalizes the requirement that an adversary interacting $l$ times with the signer should not be able to output $l+1$ valid signatures on distinct messages with non-negligible probability [2509.02189].

Blindness is often stated through an indistinguishability game. The signer adversary chooses two messages and interacts with the user; it should not be able to guess which message corresponds to which transcript better than chance. In the surveyed treatment, blindness is described as the signer’s protocol views being statistically independent of the resulting message-signature pairs, and the formal requirement is $\Pr[\text{blindness-game}_A=1]\le 1/2+\mathrm{negl}(\lambda)$ for all PPT adversaries [2509.02189].

The forward-secure blind-signature work adopts a different emphasis. It defines one-more unforgeability for context but proves forward-secure unforgeability instead. Time is partitioned into periods $t\in\{0,\ldots,T-1\}$, and exposure of the secret key for the current period $\bar t$ must not compromise signatures from periods $t<\bar t$. The corresponding game gives the adversary signing, hash, and key-update queries, permits one break-in query $BQ(\bar t)$ yielding the current secret state, and asks it to forge a valid signature for a past period on a message that was never signed in that period [2007.06884].

Blindness itself is not uniform across constructions. It can be perfect, statistical, or computational depending on the underlying tools. In the forward-secure lattice construction, blindness is achieved via statistically hiding commitments and rejection sampling and is proven in the random-oracle setting. This is distinct from the two-move NIZK-based line, where blindness is tied to statistically hiding commitments and proofs that expose only linear relations about hidden witnesses [2007.06884] [2509.02189].

## 3. Lattice assumptions and cryptographic tools

The principal hardness assumptions are SIS and LWE, together with module and ring variants in more practical constructions. The homogeneous SIS problem is stated as follows:
$$
l_2\text{-SIS}_{q,n,m,\beta}: \text{ Given } A \xleftarrow{\$} \mathbb{Z}_q^{n\times m}, \text{ find } \mathbf{x}\in \mathbb{Z}^m\setminus\{\mathbf{0}\},\ \|\mathbf{x}\|\le \beta,\ \text{ with } A\mathbf{x}\equiv \mathbf{0}\pmod q.
$$
The inhomogeneous version, denoted RSIS, asks for a short $\mathbf{x}$ such that $A\mathbf{x}\equiv \mathbf{y}\pmod q$. LWE, in decision form, asks one to distinguish noisy linear equations from uniform samples over $\mathbb{Z}_q$ [2007.06884] [2509.02189].

These assumptions support two major trapdoor mechanisms. A Type 1 trapdoor is a short basis for $\Lambda_q^\perp(A)$, satisfying $AT\equiv 0 \bmod q$ with full-rank, short columns. This is the GPV setting: short preimages can be sampled from a discrete Gaussian, and the distribution can be made trapdoor-independent. A Type 2 trapdoor is a gadget trapdoor satisfying $AR=G$ for a gadget matrix $G$, with short columns in $R$; this supports efficient lattice transformations and appears in broader lattice cryptography, although the forward-secure blind-signature construction based on concatenation and $\mathrm{ExtBasis}$ does not require explicit gadgets [2509.02189] [2007.06884].

Gaussian sampling and rejection sampling are central. GPV-style sampling produces short solutions to linear equations such as $F_tS_t=K \bmod q$, enabling hash-and-sign behavior with efficient verification. Lyubashevsky-style rejection sampling ensures that the public distribution of responses does not leak the signer’s secret short vectors. In blind signatures, rejection sampling also serves the blindness proof by making challenges and responses statistically independent of the hidden message and the signer’s internal trapdoor-derived values [2007.06884] [2509.02189].

The rationale for lattices is not only quantum resistance. The 2020 forward-secure construction explicitly relies on SIS because it is widely used to prove security of lattice-based signatures: finding a short integer solution in the kernel of a uniformly random matrix modulo $q$ is hard on average and reducible from worst-case lattice problems such as SIVP. This worst-case-to-average-case perspective is one of the defining structural differences from RSA-based blind signatures [2007.06884].

## 4. Construction paradigms and protocol families

The surveyed literature organizes lattice-based blind signatures around several design families. Early work by Rückert (2010) gave three-move Schnorr-like blind signatures over lattices. Later work by Hauck et al. (2020) identified flaws in proofs and provided the first provably secure lattice blind signature, but with large signatures of about $7.9$ MB, bounded issuance of at most $7$ signatures per key, and about $34$ MB communication. This established feasibility but also exposed the cost of proof techniques and concurrency handling [2509.02189].

A first major family is GPV-style hash-and-sign with trapdoor sampling. Agrawal et al. (2022) combine GPV signatures with Fischlin’s two-move NIZK design to obtain a very practical, unbounded-issuance, round-optimal blind signature, but the proof relies on a new one-more-inhomogeneous SIS assumption. Beullens et al. (2023) shorten the signatures further while modifying the Agrawal et al. construction to avoid the non-standard one-more ISIS assumption and incorporating techniques from Lyubashevsky et al. (2022) [2509.02189].

A second family follows identification-to-signature via Fiat–Shamir with aborts. This line inherits Lyubashevsky’s rejection-sampling methodology and is natural for Schnorr- and Okamoto-like flows over lattices. It can achieve blindness by blinding commitments or challenges and by arranging that the signature distribution is independent of the signer’s secret short vectors. However, the surveyed literature emphasizes that care is needed in concurrent settings because Schnorr/Okamoto blind signatures are vulnerable to the ROS problem, and later pROS attacks extend this vulnerability to several isogeny- and lattice-based schemes under modest concurrency [2509.02189].

A third, structurally distinct family is the round-optimal two-move construction of del Pino and Katsumata (2022). Its high-level design combines Boyen lattice signatures, BDLOP commitments, and lattice NIZKs over MSIS relations. The signer’s certificate relation is
$$
[a_1 \mid a_2 + I\cdot g]\cdot e^T = u.
$$
For blind signing, the user first commits to the message through a BDLOP commitment
$$
\mathrm{com}=[t_0\mid t_1]=[b_0\mid b_1]\cdot R + [0\mid I\cdot g],
$$
proves well-formedness by NIZK, and obtains from the signer a short certificate $e$ satisfying
$$
[a_1 \mid a_2 + t_1]\cdot e^T = u.
$$
Using the linearity of the commitment, the user transforms this into an MSIS relation with public statement $[a_1 \mid a_2 + I\cdot g \mid b_1]$ and short witness $[e; R\cdot e_2]$, then proves that relation by NIZK. The final blind signature is $\Sigma=(\mathrm{com},\pi^m,\pi^s)$, and verification checks both the commitment well-formedness proof and the MSIS proof [2509.02189].

This two-move Fischlin-style pattern is significant because it avoids the concurrency structure exploited by ROS and pROS. The same framework also supports partially blind signatures by binding a public tag $\gamma$ into the signing equation via $u-H_{M_c}(\gamma)$ and adapting the MSIS statement accordingly. Non-interactive blind signatures were later pursued through pre-signature paradigms; Baldimtsi et al. (2024) are described as the first practical lattice-based NIBS, with the signer issuing pre-signatures that the user converts into blind signatures [2509.02189].

## 5. Forward-secure lattice blind signatures

The 2020 construction gives the first blind signature that is forward secure and bases its security on the SIS assumption in the lattice setting. Its key-evolution mechanism assigns periods $t\in\{0,\ldots,2^\ell-1\}$ to the leaves of a full binary tree of depth $\ell$. For a node $w^{(i)}=(w_1,\ldots,w_i)$, the associated public matrix is
$$
F_{w^{(i)}} := [A_0 \,\|\, A_1^{(w_1)} \,\|\, \cdots \,\|\, A_i^{(w_i)}] \in \mathbb{Z}_q^{n\times im},
$$
and for a leaf period $t=(t_1,\ldots,t_\ell)$,
$$
F_t := [A_0 \,\|\, A_1^{(t_1)} \,\|\, \cdots \,\|\, A_\ell^{(t_\ell)}] \in \mathbb{Z}_q^{n\times (\ell+1)m}.
$$
Forward security is obtained through trapdoor delegation: a trapdoor for a deeper node can be derived from an ancestor’s trapdoor, but cannot be lifted back to recover an ancestor’s trapdoor, so exposure of the current period key does not recover past keys [2007.06884].

The setup samples $(A_0,T_{A_0})\leftarrow \mathrm{TrapGen}(q,n)$, uniformly samples the branch matrices $A_i^{(b)}$ and a public target matrix $K\in\mathbb{Z}_q^{n\times k}$, and stores trapdoors only for a minimal cover $\mathrm{Node}(t)$ of future periods. Key evolution from $t$ to $t+1$ derives new trapdoors for $\mathrm{Node}(t+1)\setminus \mathrm{Node}(t)$ using $\mathrm{ExtBasis}$ and deletes trapdoors for $\mathrm{Node}(t)\setminus \mathrm{Node}(t+1)$. The size of $\mathrm{Node}(t)$ is $O(\log T)$, so both key-update cost and secret-state size are logarithmic in the number of periods [2007.06884].

The blind-signing protocol itself blends GPV and Lyubashevsky techniques. At period $t$, the signer forms $F_t$, computes a short preimage matrix $S_t$ such that $F_tS_t=K \bmod q$, samples $\mathbf r$, and sends
$$
x = F_t\mathbf r.
$$
The user samples blinding values $\mathbf a$, $\mathbf b$, and $d'$, computes
$$
u = x + F_t\mathbf a + K\mathbf b \pmod q,\qquad c=\mathrm{com}(m,d'),
$$
sets
$$
e' = H(u,c),\qquad e=e'+b,
$$
and uses rejection sampling so that $e$ has the exact target distribution. The signer replies with
$$
z = r + S_t e,
$$
again filtered by rejection sampling, and the user unblinds with
$$
z' = z + a.
$$
If $\|z'\|\le \sigma_3\sqrt{(\ell+1)m}$, the signature is $\Sigma=(d',e',z')$ [2007.06884].

Verification reconstructs $F_t$ and computes
$$
\hat e = H(F_tz' - Ke' \pmod q,\mathrm{com}(m,d')).
$$
Acceptance requires $\hat e=e'$ and the norm bound on $z'$. Correctness follows from the relation $F_tS_t=K \bmod q$, which implies
$$
F_t z' - K e' \equiv x + F_t a + K b \equiv u \pmod q.
$$
Blindness is proved from statistically hiding commitments and the exact output distributions induced by rejection sampling: the signer’s challenge view is independent of the message, and the final response distribution is independent of the signer’s internal state. Forward-secure unforgeability is proved in the random-oracle model by a forking-lemma reduction to $l_2$-SIS, with theorem parameter
$$
\beta=\max\Big\{ (2\sigma_3+2\sigma\sqrt{\kappa})\sqrt{(\ell+1)m},\ (2\sigma_3+\sigma_2)\sqrt{(\ell+1)m} \Big\}.
$$
The reduction is non-tight because it uses a guess of the target period and rewinding [2007.06884].

## 6. Efficiency, applications, and limitations

The reported performance landscape shows a clear progression from feasibility to more compact, round-optimal designs. The following figures are explicitly reported for representative schemes [2509.02189].

| Scheme | Signature | Communication / note |
|---|---:|---|
| Hauck et al. (2020) | $\sim 7.9$ MB | $\sim 34$ MB; bounded issuance $\le 7$ |
| Lyubashevsky et al. (2022) | $\sim 150$ KB | $\sim 16$ MB |
| Agrawal et al. (2022) | $\sim 45$ KB | round-optimal; unbounded issuance |
| del Pino and Katsumata (2022) | $\sim 100$ KB | $\sim 850$ KB |
| Beullens et al. (2023) | $\sim 22$ KB | round-optimal |
| Baldimtsi et al. (2024) | $\sim 68$ KB | $\sim 0.96$ KB; lattice NIBS |

These numbers support two general observations. First, lattice blind signatures remain larger than classical blind signatures: the same survey reports approximately $384$-byte RSA blind signatures with $3072$-bit RSA and approximately $128$-byte EC-based blind signatures on $256$-bit curves, whereas lattice schemes still occupy the $\sim 22$ KB to $\sim 150$ KB range. Second, the most substantial improvements come from two-move constructions, module or ring structure, and proof systems that compress the blindness and correctness arguments into NIZKs rather than longer interactive transcripts [2509.02189].

For the forward-secure construction, the efficiency claims are asymptotic rather than concrete. A signature is $\Sigma=(d',e',z')$, where $d'\in\{0,1\}^n$, $e'\in R_H\subset\{-1,0,1\}^k$ with $\|e'\|\le \kappa$, and $z'\in\mathbb{Z}^{(\ell+1)m}$. The public key contains $A_0$, the $2\ell$ branch matrices $A_i^{(b)}$, and $K$, for total size $O(nm(2\ell+1)\log q + nk\log q)$ bits. The secret state stores trapdoors for $O(\log T)$ nodes, with memory $O(m^2\log T)$ integers. Key update requires $O(\log T)$ calls to $\mathrm{ExtBasis}$, verification requires one computation of $F_tz'-Ke'$, one hash, and one norm check, and the protocol has four message flows per signature, with occasional restarts [2007.06884].

Implementation concerns are dominated by sampling and side-channel discipline. The forward-secure work explicitly recommends constant-time discrete Gaussian samplers, careful control of Gram–Schmidt norms in $\mathrm{TrapGen}$ and $\mathrm{ExtBasis}$, constant-time commitments and hashes, and masking or re-randomizing norm checks and rejection decisions. Larger $\sigma$ improves rejection probability but enlarges signatures; larger $k$ and $\kappa$ raise downstream parameters $\sigma_1,\sigma_2,\sigma_3$; increasing the tree depth $\ell$ enlarges the public key and the response dimension [2007.06884].

Applications follow the classical blind-signature trajectory but in a post-quantum setting. The 2025 survey emphasizes e-cash, e-voting, and anonymous credentials. Partially blind signatures are especially relevant to e-cash because they allow public attributes such as validity windows and denominations to be embedded into the signed object. Bootle et al. (2023) are described as giving blind signatures convertible into anonymous credentials, and the del Pino–Katsumata construction is presented as a natural fit for partially blind signatures in the ROM and QROM [2509.02189].

The main limitations are also consistent across the literature. Many proofs rely on the ROM or QROM, reductions are often non-tight, some schemes use non-standard one-more ISIS variants, and interactive or Schnorr-style designs require careful treatment of concurrency because ROS and pROS attacks can invalidate one-more unforgeability under concurrent sessions. Large public keys, Gaussian or rejection-sampling cost, and proof-system overhead remain central obstacles. A plausible implication is that future progress will depend less on the blind-signature abstraction itself than on reductions in NIZK cost, improved module or ring instantiations, and tighter security analyses under standard assumptions [2509.02189] [2007.06884].

Source: https://www.emergentmind.com/topics/lattice-based-blind-signatures