Chaum's blind signature let a bank sign what it could not read

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

A signature that authenticates without identifying

David Chaum's paper 'Blind Signatures for Untraceable Payments', presented at the CRYPTO '82 conference, describes a way for a signer to certify a message without seeing its content. The paper's own analogy is a carbon-lined envelope: a voter seals a ballot inside it, a trustee signs the outside, and the signature transfers through the carbon paper onto the ballot without the trustee reading what was written. Applied to money, a bank can sign a note of fixed value without learning which customer it belongs to, then later accept that note back from a payee never linked to the payer.

What the scheme requires to work

Chaum's construction rests on three functions: a signing function known only to the issuer, a commuting function the requester applies before and after signing to blind and unblind the message, and a redundancy check that stops forgery. The paper states plainly that anything the bank signs this way is worth a fixed amount, and that the bank still clears every note against a master list to catch reuse. The privacy is real: the bank cannot connect the note it signed to the note it later redeems. The dependence on the bank is also real: it alone decides who may open an account, and it alone runs the clearing list that prevents double-spending.

What survived into Bitcoin and what did not

Chaum later commercialised this design through the company DigiCash. Bitcoin's peer-to-peer electronic cash paper keeps the anonymity goal — transactions are published without attaching identities to public keys — but removes the issuer entirely. There is no bank whose signature makes a coin valid; instead a coin is a chain of digital signatures, checked by many independent nodes, and double-spending is prevented by public agreement on transaction order rather than a private clearing list. The trade is visible: Chaum's design hides amounts and counterparties from the issuer but keeps a single point of control; Bitcoin's ledger is public and hides little about the transaction graph, but no single party can refuse to honour it.

Where the comparison breaks down

Neither document proves anything about how either system resists real attackers over decades, and neither solves the other's specific privacy problem: Chaum's blind signatures do not address double-spending without a mint, and Bitcoin's public ledger does not hide who transacts with whom once one address is linked to an identity. Treating either as a finished answer to financial privacy is a category error that reading both papers together discourages.

• Does removing a trusted issuer also remove the privacy that issuer used to provide?
• Who can see a transaction graph, and what happens once one address in it is identified?
• What specific failure is privacy addressing here — a nosy bank, a public ledger, or a legal subpoena?

Read side by side, the two papers describe a trade-off rather than a lineage of improvement: one hides transaction detail from a trusted party, the other removes the trusted party but publishes the detail instead.