Package org.bouncycastle.crypto.signers

Class RSABlindSignatureServer

  • public class RSABlindSignatureServer
extends java.lang.Object
    Server side of the RSA Blind Signature Scheme with Appendix (RSABSSA) defined in RFC 9474. Implements the BlindSign step (sec. 4.3): given a blinded message produced by RSABlindSignatureClient.blind(byte[]), compute s = m^d mod n and return it, after a self-consistency check (s^e == m mod n) that catches CRT faults before the value leaves the server.

    The private-key operation is driven through RSABlindedEngine so the modular exponentiation is itself blinded against timing side-channels — orthogonal to the RFC 9474 client/server blinding, which only hides the message.

    The variant choice (PSS vs PSSZERO, randomised vs deterministic) is opaque to the server — only the client cares — so this class is variant-agnostic.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      byte[] blindSign​(byte[] blindedMsg)
      RFC 9474 sec. 4.3 BlindSign.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • RSABlindSignatureServer

        public RSABlindSignatureServer​(RSAKeyParameters privateKey)
        Parameters:
        privateKey - the server's RSA private key. CRT-form (RSAPrivateCrtKeyParameters) is strongly recommended; the public exponent must be available for the RSAVP1 self-check (RFC 9474 sec. 4.3 step 3).

    • Method Detail

      • blindSign

        public byte[] blindSign​(byte[] blindedMsg)
                 throws CryptoException
        RFC 9474 sec. 4.3 BlindSign. Verifies blindedMsg as an integer in [0, n) of the modulus length, applies RSASP1, and checks that RSAVP1 round-trips back to the input before returning.
        Parameters:
        blindedMsg - the blinded message received from the client; must be exactly modulus_len bytes.
        Returns:
        the blinded signature, modulus_len bytes.
        Throws:
        CryptoException - if the input is the wrong length, out of range, or the RSASP1/RSAVP1 round-trip fails (CRT fault).