Class RSABlindSignatureClient

java.lang.Object
org.bouncycastle.crypto.signers.RSABlindSignatureClient
public class RSABlindSignatureClient extends Object
Client side of the RSA Blind Signature Scheme with Appendix (RSABSSA) defined in RFC 9474. A single blind(byte[]) call performs both Prepare (sec. 4.1) and Blind (sec. 4.2); finalize(Blinded, byte[]) performs Finalize (sec. 4.4). The BlindSign server step lives in RSABlindSignatureServer and the variant choices in RSABlindSignatureParameters.

The client side is therefore two calls — blind then finalize — with the server's BlindSign in between: 

RSABlindSignatureClient client = new RSABlindSignatureClient(
    RSABlindSignatureParameters.RSABSSA_SHA384_PSS_RANDOMIZED, publicKey);

RSABlindSignatureClient.Blinded blinded = client.blind(msg);

// send blinded.getBlindedMessage() to the server; receive blind_sig

byte[] sig = client.finalize(blinded, blindSig);
// (blinded.getPreparedMessage(), sig) is the RSASSA-PSS pair verifiers check
The SecureRandom used for the prepare prefix, the EMSA-PSS salt, and the blinding factor is supplied at construction; the (parameters, publicKey) convenience constructor uses the CryptoServicesRegistrar default.

Blind is expressed on the existing BC RSA blinding toolkit — RSABlindingFactorGenerator, RSABlindingParameters and PSSSigner driven by an RSABlindingEngine — the same composition PSSBlindTest uses for Chaum RSA-PSS blind signing.

Each request's state is carried by the returned RSABlindSignatureClient.Blinded (the blinded message, the prepared message, and the secret unblinding value), so a single instance is reusable across requests.

For randomised variants the resulting signature is over a prepared message that prepends a fresh 32-byte prefix to msg (RFC 9474 sec. 4.1); that prepared message — RSABlindSignatureClient.Blinded.getPreparedMessage() — is what downstream verifiers check the signature against, not the original msg.