\section{Blind Signatures}\label{blind_signatures}
One important cryptographic scheme used by the Donau is the blind signature
scheme. It is an extension of digital signatures which provides, besides
authenticity and non-repudiation, privacy by allowing a user to obtain a
signature for a message, without revealing the contents of the message to the
signer. All cryptographic elements used by the Donau where provided by the GNU
Taler libraries. Blind signatures are slightly slower than the normal
signatures, this does not result in a performance issue as this project on GNU
Taler shows: \cite{taler-cs}.

This section only provides an overview of blinded signatures. Detailed
information about blinded signatures can be found at
\url{https://taler.net/papers/cs-thesis.pdf}. Blinded signatures are the key
elements to reach privacy for the donor (see section
\ref{issuing_donation_receipts}). With blinded signatures a blinded
unrecognizable message was signed. Only the creator of the blinded message is
able to unblind the signature and therefore to receive a valid signature for
the unblinded message. The Donau system uses blinded signatures to bind the
identity to a donation receipt while hiding the identity of the donor. As a
result of the property of blindness, the blind signer (in this case the Donau)
is not able to link the clear-text message with the made blind signature
or the blind signature with the unblind signature \cite[p.12]{cryptoeprint:2019/877}.

There are multiple blind signature schemes. The Donau distinguishes
the following two equivalent blind signature schemes:

\subsection{RSA}\label{rsa}
Concrete the RSA-FDH blind signatures are used. Before blinding, to eliminate
certain attacks, a Full-Domain Hash (FDH) is applied on the message.
Full-Domain means the hash has the same size as the RSA modulus. The blind
signature scheme is similar to the normal RSA signature scheme. In addition to
the normal scheme, the message is blinded with a private and random value.
Practically the length of the modulus and therefore for the key size, signature
size and the security level is variable. The scheme only has one round trip.\cite{nigelcrypto:2016}

\subsection{Clause Schnorr (CS)}\label{cs}
The Clause Schnorr Signature Scheme differs from the RSA scheme. Initially the
blinder needs two random values from the signer party. One random value from
the signer and two random private values are required to blind the message
once. This process is repeated and the two blinded messages are sent to the
signer, who randomly selects a blinded message for blinding. Two blinded
messages are needed to prevent an certain type of attack. In comparison to the
RSA scheme, the Clause Schnorr Scheme needs an additional round trip to get the
initial nonces from the signer. However, the individual crypto operations are so
much faster than the operations from the RSA scheme that the additional round
trip is no longer significant.\cite{DemHeuz2022}

Because Clause Schnorr signatures are based on elliptic curves, smaller keys
can be used. GNU Taler supports one fixed 256 bit key size, which provides an
security level of 128 bits. The exact processes of this signature scheme do not
need to be understood in order to understand this thesis.

