THE GARDEN

RSA Blinding Attack (Signature Malleability)

Updated 13 Sep 2026

• •

  What it is

  • •

    Textbook RSA signing is multiplicatively homomorphic: $\text{Sign}(m_1) \cdot \text{Sign}(m_2) \equiv \text{Sign}(m_1 \cdot m_2) \pmod N$. This lets an attacker get a forbidden message signed indirectly: multiply it by a random "blinding factor" $r^e$ before submitting for signing (disguising its raw bytes so a content filter doesn't recognize it), receive back a signature over the disguised value, then multiply that signature by $r^{-1}$ to strip the blinding factor out and recover a valid signature over the original, forbidden message — one the server would have refused to sign directly.

• •

  When to apply

  • •

    A signing service checks the raw content of a message before signing it (e.g. rejecting anything containing a specific forbidden substring) but doesn't defend against the message being multiplicatively disguised first — textbook (unpadded) RSA signing is the giveaway, since real padding schemes (PSS) break this homomorphism.

• •

  Math

  • •

    $m' \equiv m \cdot r^e \pmod N$; server returns $S' \equiv (m')^d \equiv m^d \cdot r^{ed} \equiv m^d \cdot r \pmod N$ (since $ed\equiv 1 \pmod{\phi(N)}$); unblind via $S \equiv S' \cdot r^{-1} \equiv m^d \pmod N$.

• •

  Worked example

  • •

    Blinding a "forbidden" integer with a small random factor $r=7$ before requesting a signature, then unblinding the returned signature with $r^{-1} \bmod N$, produced a signature that verified correctly against the original forbidden message.

• •

  Python

  • •

    r = 2
    m_prime = (m_forbidden * pow(r, e, N)) % N
    S_prime = sign(m_prime)             # server signs the disguised value
    S = (S_prime * pow(r, -1, N)) % N   # unblind
    assert pow(S, e, N) == m_forbidden
    

• •

  Related

  • •

    RSA (Textbook Construction)

• •

  Cards

  • •

    What algebraic property of textbook RSA signing does the blinding attack exploit?

    • •

      Multiplicative homomorphism: Sign(m1)·Sign(m2) ≡ Sign(m1·m2) (mod N).

  • •

    Why does content-based filtering on the raw message fail to stop this attack?

    • •

      The blinded message m·r^e has completely different raw bytes from the forbidden message, so a filter checking for a specific substring/value doesn't recognize it — yet the blinding factor cancels out cleanly afterward.

◌ Explore connections in Graph view