Imagine handing a notary a sealed envelope with carbon paper inside, having them stamp the outside, and walking away with their signature pressed onto a document they never read. That is a blind signature — and it is the cryptographic foundation for anonymous tokens, untraceable digital cash, and credentials that prove you are authorized without revealing who you are.
A blind signature, introduced by cryptographer David Chaum in 1982, is a form of digital signature where the signer does not see the content of the message being signed. The recipient later "unblinds" the result to obtain a valid signature on the original message — one that anyone can verify against the signer's public key, but that the signer cannot link back to the specific signing session. It sounds paradoxical: how can a signature be valid on something the signer never saw? The answer lies in the algebra of how some signature schemes work.
The Sealed Envelope, Made Mathematical
The carbon-paper envelope is the right intuition, and it maps cleanly onto the math. The protocol has three moves:
Blind. The user takes their message and multiplies in a secret random "blinding factor." The result looks like meaningless noise to anyone who doesn't know that factor. This is the sealed envelope.
