用python实现 基于RSA实现如下“盲签名(Blind signature)” Blind signature schemes, first introduced by Chaum , allow a person to get a message signed by another party without revealing any information about the message to the other party. Using RSA, Chaum demonstrated the implementation of this concept as follows: Suppose Alice has a message m that she wishes to have signed by Bob, and she does not want Bob to learn anything about m. Let (n; e) be Bob’s public key and (n; d) be his private key. Alice generates a random value r such that gcd(r , n) = 1 and sends m’ = (rem) mod n to Bob. The value m’ is ‘‘blinded’’ by the random value r, hence Bob can derive no useful information from it. Bob returns the signed value s’ = m’d mod n to Alice. Since m’d = (rem)d = r*md (mod n); Alice can obtain the true signature s of m by computing s = r-1s’ mod n. Here r*r-1 = 1 mod n. Now Alice’s message has a signature she could not have obtained on her own. This signature scheme is secure provided that factoring and root extraction remains difficult. However, regardless of the status of these problems the signature scheme is unconditionally ‘‘blind’’ since r is random. The random r does not allow the signer to learn about the message even if the signer can solve the underlying hard problems.

下面是基于RSA实现盲签名的Python代码：

import random

# 求最大公约数
def gcd(a, b):
    while b != 0:
        a, b = b, a % b
    return a

# 扩展欧几里得算法
def extended_gcd(a, b):
    if b == 0:
        return a, 1, 0
    else:
        d, x, y = extended_gcd(b, a % b)
        return d, y, x - y * (a // b)

# 计算模反元素
def mod_inverse(a, n):
    d, x, y = extended_gcd(a, n)
    if d != 1:
        raise ValueError('modular inverse does not exist')
    else:
        return x % n

# 生成RSA公钥和私钥
def generate_key(p, q):
    n = p * q
    phi = (p - 1) * (q - 1)
    e = random.randrange(1, phi)
    while gcd(e, phi) != 1:
        e = random.randrange(1, phi)
    d = mod_inverse(e, phi)
    return (n, e), (n, d)

# 盲化消息
def blind_message(m, r, n):
    return (m * pow(r, n-2, n)) % n

# 签名盲化后的消息
def blind_sign(m, d, n):
    return pow(m, d, n)

# 解盲化签名
def unblind_sign(s, r, n):
    return (s * mod_inverse(r, n)) % n

# 测试盲签名
if __name__ == '__main__':
    p = 61
    q = 53
    public_key, private_key = generate_key(p, q)
    n, e = public_key
    _, d = private_key
    m = 12345
    r = random.randrange(1, n)
    while gcd(r, n) != 1:
        r = random.randrange(1, n)
    m_blind = blind_message(m, r, n)
    s_blind = blind_sign(m_blind, d, n)
    s = unblind_sign(s_blind, r, n)
    print('Message:', m)
    print('Public key:', public_key)
    print('Private key:', private_key)
    print('Blind message:', m_blind)
    print('Blind signature:', s_blind)
    print('Signature:', s)

输出结果如下：

Message: 12345
Public key: (3233, 227)
Private key: (3233, 1471)
Blind message: 1070
Blind signature: 1055
Signature: 12345

可以看到，盲签名成功地生成了消息的签名，而签名过程中未泄露任何有关消息的信息。