Paper 2026/676 Original: eprint.iacr.org/2026/676 ↗

An Efficient SM9-Compatible Identity-Based Blind Signature Scheme for One-Time Issuance Identities

Abstract

We present an identity-based blind signature scheme built on the SM9 Chinese national cryptographic standard. The scheme outputs standard SM9 signatures, removes all online pairing operations through a single setup-time pre-computation, and adds only one user-side exponentiation to achieve blindness. We prove two properties rigorously: \emph{restricted target-identity unforgeability} (RTU) under the $Q$-BCAA1 assumption, and \emph{computational blindness} against a malicious signer in the random oracle model (ROM), where the signer is given the final signatures and still cannot link them to its protocol views. We state clearly that RTU is strictly weaker than the standard one-more unforgeability (OMU) notion for blind signatures: RTU forbids signing queries on the target identity and is therefore meaningful only when that identity encodes a fresh, one-time issuance context, as occurs in coin-, ballot-, and credential-issuance protocols. The $Q$-BCAA1 assumption is the inversion-type assumption that matches the SM9 private-key structure $d_{\ID}=[s/(s+\tau)]P_1$; it lets the reduction answer adaptive key-extraction queries without any decisional (Gap) oracle. We give a partial-blind extension with a formal partial-blindness model, discuss implementation requirements, and compare costs against prior SM9-based proposals.