1 files changed, 713 insertions, 0 deletions

diff --git a/src/lib/util/crypto_blind_sign.c b/src/lib/util/crypto_blind_sign.c
new file mode 100644
index 000000000..ac611cf4f
--- /dev/null
+++ b/src/lib/util/crypto_blind_sign.c
@@ -0,0 +1,713 @@
+/*
+  This file is part of GNUNET
+  Copyright (C) 2021, 2022, 2023 GNUnet e.V.
+
+  GNUNET is free software; you can redistribute it and/or modify it under the
+  terms of the GNU General Public License as published by the Free Software
+  Foundation; either version 3, or (at your option) any later version.
+
+  GNUNET is distributed in the hope that it will be useful, but WITHOUT ANY
+  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+  A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License along with
+  GNUNET; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file crypto_blind_sign.c
+ * @brief blind signatures (abstraction over RSA or CS)
+ * @author Christian Grothoff
+ */
+#include "platform.h"
+#include "gnunet_util_lib.h"
+
+
+void
+GNUNET_CRYPTO_blinding_input_values_decref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm)
+{
+  GNUNET_assert (bm->rc > 0);
+  bm->rc--;
+  if (0 != bm->rc)
+    return;
+  switch (bm->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    bm->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    bm->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (bm);
+}
+
+
+void
+GNUNET_CRYPTO_blind_sign_priv_decref (struct
+                                      GNUNET_CRYPTO_BlindSignPrivateKey *
+                                      bsign_priv)
+{
+  GNUNET_assert (bsign_priv->rc > 0);
+  bsign_priv->rc--;
+  if (0 != bsign_priv->rc)
+    return;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != bsign_priv->details.rsa_private_key)
+    {
+      GNUNET_CRYPTO_rsa_private_key_free (bsign_priv->details.rsa_private_key);
+      bsign_priv->details.rsa_private_key = NULL;
+    }
+    bsign_priv->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    bsign_priv->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (bsign_priv);
+}
+
+
+void
+GNUNET_CRYPTO_blind_sign_pub_decref (struct
+                                     GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  GNUNET_assert (bsign_pub->rc > 0);
+  bsign_pub->rc--;
+  if (0 != bsign_pub->rc)
+    return;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != bsign_pub->details.rsa_public_key)
+    {
+      GNUNET_CRYPTO_rsa_public_key_free (bsign_pub->details.rsa_public_key);
+      bsign_pub->details.rsa_public_key = NULL;
+    }
+    bsign_pub->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    break;
+  }
+  GNUNET_free (bsign_pub);
+}
+
+
+void
+GNUNET_CRYPTO_unblinded_sig_decref (struct
+                                    GNUNET_CRYPTO_UnblindedSignature *ub_sig)
+{
+  GNUNET_assert (ub_sig->rc > 0);
+  ub_sig->rc--;
+  if (0 != ub_sig->rc)
+    return;
+  switch (ub_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != ub_sig->details.rsa_signature)
+    {
+      GNUNET_CRYPTO_rsa_signature_free (ub_sig->details.rsa_signature);
+      ub_sig->details.rsa_signature = NULL;
+    }
+    ub_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    ub_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (ub_sig);
+}
+
+
+void
+GNUNET_CRYPTO_blinded_sig_decref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig)
+{
+  GNUNET_assert (blind_sig->rc > 0);
+  blind_sig->rc--;
+  if (0 != blind_sig->rc)
+    return;
+  switch (blind_sig->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (NULL != blind_sig->details.blinded_rsa_signature)
+    {
+      GNUNET_CRYPTO_rsa_signature_free (
+        blind_sig->details.blinded_rsa_signature);
+      blind_sig->details.blinded_rsa_signature = NULL;
+    }
+    blind_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    blind_sig->cipher = GNUNET_CRYPTO_BSA_INVALID;
+    break;
+  }
+  GNUNET_free (blind_sig);
+}
+
+
+void
+GNUNET_CRYPTO_blinded_message_decref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm)
+{
+  GNUNET_assert (bm->rc > 0);
+  bm->rc--;
+  if (0 != bm->rc)
+    return;
+  switch (bm->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    GNUNET_free (bm->details.rsa_blinded_message.blinded_msg);
+    break;
+  case GNUNET_CRYPTO_BSA_CS:
+    break;
+  }
+  GNUNET_free (bm);
+}
+
+
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_blinded_message_incref (
+  struct GNUNET_CRYPTO_BlindedMessage *bm)
+{
+  bm->rc++;
+  return bm;
+}
+
+
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_blinding_input_values_incref (
+  struct GNUNET_CRYPTO_BlindingInputValues *bm)
+{
+  bm->rc++;
+  return bm;
+}
+
+
+struct GNUNET_CRYPTO_BlindSignPublicKey *
+GNUNET_CRYPTO_bsign_pub_incref (
+  struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  bsign_pub->rc++;
+  return bsign_pub;
+}
+
+
+struct GNUNET_CRYPTO_BlindSignPrivateKey *
+GNUNET_CRYPTO_bsign_priv_incref (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv)
+{
+  bsign_priv->rc++;
+  return bsign_priv;
+}
+
+
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_ub_sig_incref (struct GNUNET_CRYPTO_UnblindedSignature *ub_sig)
+{
+  ub_sig->rc++;
+  return ub_sig;
+}
+
+
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sig_incref (
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig)
+{
+  blind_sig->rc++;
+  return blind_sig;
+}
+
+
+int
+GNUNET_CRYPTO_bsign_pub_cmp (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp1,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bp2)
+{
+  if (bp1->cipher != bp2->cipher)
+    return (bp1->cipher > bp2->cipher) ? 1 : -1;
+  switch (bp1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_memcmp (&bp1->pub_key_hash,
+                          &bp2->pub_key_hash);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&bp1->pub_key_hash,
+                          &bp2->pub_key_hash);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_ub_sig_cmp (
+  const struct GNUNET_CRYPTO_UnblindedSignature *sig1,
+  const struct GNUNET_CRYPTO_UnblindedSignature *sig2)
+{
+  if (sig1->cipher != sig2->cipher)
+    return (sig1->cipher > sig2->cipher) ? 1 : -1;
+  switch (sig1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_CRYPTO_rsa_signature_cmp (sig1->details.rsa_signature,
+                                            sig2->details.rsa_signature);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&sig1->details.cs_signature,
+                          &sig2->details.cs_signature);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_blind_sig_cmp (
+  const struct GNUNET_CRYPTO_BlindedSignature *sig1,
+  const struct GNUNET_CRYPTO_BlindedSignature *sig2)
+{
+  if (sig1->cipher != sig2->cipher)
+    return (sig1->cipher > sig2->cipher) ? 1 : -1;
+  switch (sig1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return GNUNET_CRYPTO_rsa_signature_cmp (sig1->details.blinded_rsa_signature,
+                                            sig2->details.blinded_rsa_signature);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&sig1->details.blinded_cs_answer,
+                          &sig2->details.blinded_cs_answer);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+int
+GNUNET_CRYPTO_blinded_message_cmp (
+  const struct GNUNET_CRYPTO_BlindedMessage *bp1,
+  const struct GNUNET_CRYPTO_BlindedMessage *bp2)
+{
+  if (bp1->cipher != bp2->cipher)
+    return (bp1->cipher > bp2->cipher) ? 1 : -1;
+  switch (bp1->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return 0;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (bp1->details.rsa_blinded_message.blinded_msg_size !=
+        bp2->details.rsa_blinded_message.blinded_msg_size)
+      return (bp1->details.rsa_blinded_message.blinded_msg_size >
+              bp2->details.rsa_blinded_message.blinded_msg_size) ? 1 : -1;
+    return memcmp (bp1->details.rsa_blinded_message.blinded_msg,
+                   bp2->details.rsa_blinded_message.blinded_msg,
+                   bp1->details.rsa_blinded_message.blinded_msg_size);
+  case GNUNET_CRYPTO_BSA_CS:
+    return GNUNET_memcmp (&bp1->details.cs_blinded_message,
+                          &bp2->details.cs_blinded_message);
+  }
+  GNUNET_assert (0);
+  return -2;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  ...)
+{
+  enum GNUNET_GenericReturnValue ret;
+  va_list ap;
+
+  va_start (ap,
+            cipher);
+  ret = GNUNET_CRYPTO_blind_sign_keys_create_va (bsign_priv,
+                                                 bsign_pub,
+                                                 cipher,
+                                                 ap);
+  va_end (ap);
+  return ret;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sign_keys_create_va (
+  struct GNUNET_CRYPTO_BlindSignPrivateKey **bsign_priv,
+  struct GNUNET_CRYPTO_BlindSignPublicKey **bsign_pub,
+  enum GNUNET_CRYPTO_BlindSignatureAlgorithm cipher,
+  va_list ap)
+{
+  struct GNUNET_CRYPTO_BlindSignPrivateKey *priv;
+  struct GNUNET_CRYPTO_BlindSignPublicKey *pub;
+
+  priv = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPrivateKey);
+  priv->rc = 1;
+  priv->cipher = cipher;
+  *bsign_priv = priv;
+  pub = GNUNET_new (struct GNUNET_CRYPTO_BlindSignPublicKey);
+  pub->rc = 1;
+  pub->cipher = cipher;
+  *bsign_pub = pub;
+  switch (cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    break;
+  case GNUNET_CRYPTO_BSA_RSA:
+    {
+      unsigned int bits;
+
+      bits = va_arg (ap,
+                     unsigned int);
+      if (bits < 512)
+      {
+        GNUNET_break (0);
+        break;
+      }
+      priv->details.rsa_private_key
+        = GNUNET_CRYPTO_rsa_private_key_create (bits);
+    }
+    if (NULL == priv->details.rsa_private_key)
+    {
+      GNUNET_break (0);
+      break;
+    }
+    pub->details.rsa_public_key
+      = GNUNET_CRYPTO_rsa_private_key_get_public (
+          priv->details.rsa_private_key);
+    GNUNET_CRYPTO_rsa_public_key_hash (pub->details.rsa_public_key,
+                                       &pub->pub_key_hash);
+    return GNUNET_OK;
+  case GNUNET_CRYPTO_BSA_CS:
+    GNUNET_CRYPTO_cs_private_key_generate (&priv->details.cs_private_key);
+    GNUNET_CRYPTO_cs_private_key_get_public (
+      &priv->details.cs_private_key,
+      &pub->details.cs_public_key);
+    GNUNET_CRYPTO_hash (&pub->details.cs_public_key,
+                        sizeof(pub->details.cs_public_key),
+                        &pub->pub_key_hash);
+    return GNUNET_OK;
+  }
+  GNUNET_free (priv);
+  GNUNET_free (pub);
+  *bsign_priv = NULL;
+  *bsign_pub = NULL;
+  return GNUNET_SYSERR;
+}
+
+
+struct GNUNET_CRYPTO_BlindingInputValues *
+GNUNET_CRYPTO_get_blinding_input_values (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const char *salt)
+{
+  struct GNUNET_CRYPTO_BlindingInputValues *biv;
+
+  biv = GNUNET_new (struct GNUNET_CRYPTO_BlindingInputValues);
+  biv->cipher = bsign_priv->cipher;
+  biv->rc = 1;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (biv);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    return biv;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsRSecret cspriv[2];
+
+      GNUNET_CRYPTO_cs_r_derive (&nonce->cs_nonce,
+                                 salt,
+                                 &bsign_priv->details.cs_private_key,
+                                 cspriv);
+      GNUNET_CRYPTO_cs_r_get_public (&cspriv[0],
+                                     &biv->details.cs_values.r_pub[0]);
+      GNUNET_CRYPTO_cs_r_get_public (&cspriv[1],
+                                     &biv->details.cs_values.r_pub[1]);
+      return biv;
+    }
+  }
+  GNUNET_break (0);
+  GNUNET_free (biv);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_BlindedMessage *
+GNUNET_CRYPTO_message_blind_to_sign (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const union GNUNET_CRYPTO_BlindSessionNonce *nonce,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values)
+{
+  struct GNUNET_CRYPTO_BlindedMessage *bm;
+
+  bm = GNUNET_new (struct GNUNET_CRYPTO_BlindedMessage);
+  bm->cipher = bsign_pub->cipher;
+  bm->rc = 1;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (bm);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (GNUNET_YES !=
+        GNUNET_CRYPTO_rsa_blind (
+          message,
+          message_size,
+          &bks->rsa_bks,
+          bsign_pub->details.rsa_public_key,
+          &bm->details.rsa_blinded_message))
+    {
+      GNUNET_break (0);
+      GNUNET_free (bm);
+      return NULL;
+    }
+    return bm;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CSPublicRPairP blinded_r_pub;
+      struct GNUNET_CRYPTO_CsBlindingSecret bs[2];
+
+      if (NULL == nonce)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (bm);
+        return NULL;
+      }
+      GNUNET_CRYPTO_cs_blinding_secrets_derive (&bks->nonce,
+                                                bs);
+      GNUNET_CRYPTO_cs_calc_blinded_c (
+        bs,
+        alg_values->details.cs_values.r_pub,
+        &bsign_pub->details.cs_public_key,
+        message,
+        message_size,
+        bm->details.cs_blinded_message.c,
+        &blinded_r_pub);
+      bm->details.cs_blinded_message.nonce = nonce->cs_nonce;
+      (void) blinded_r_pub;
+      return bm;
+    }
+  }
+  GNUNET_break (0);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_BlindedSignature *
+GNUNET_CRYPTO_blind_sign (
+  const struct GNUNET_CRYPTO_BlindSignPrivateKey *bsign_priv,
+  const char *salt,
+  const struct GNUNET_CRYPTO_BlindedMessage *blinded_message)
+{
+  struct GNUNET_CRYPTO_BlindedSignature *blind_sig;
+
+  if (blinded_message->cipher != bsign_priv->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+
+  blind_sig = GNUNET_new (struct GNUNET_CRYPTO_BlindedSignature);
+  blind_sig->cipher = bsign_priv->cipher;
+  blind_sig->rc = 1;
+  switch (bsign_priv->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (blind_sig);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    blind_sig->details.blinded_rsa_signature
+      = GNUNET_CRYPTO_rsa_sign_blinded (
+          bsign_priv->details.rsa_private_key,
+          &blinded_message->details.rsa_blinded_message);
+    if (NULL == blind_sig->details.blinded_rsa_signature)
+    {
+      GNUNET_break (0);
+      GNUNET_free (blind_sig);
+      return NULL;
+    }
+    return blind_sig;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsRSecret r[2];
+
+      GNUNET_CRYPTO_cs_r_derive (
+        &blinded_message->details.cs_blinded_message.nonce,
+        salt,
+        &bsign_priv->details.cs_private_key,
+        r);
+      GNUNET_CRYPTO_cs_sign_derive (
+        &bsign_priv->details.cs_private_key,
+        r,
+        &blinded_message->details.cs_blinded_message,
+        &blind_sig->details.blinded_cs_answer);
+    }
+    return blind_sig;
+  }
+  GNUNET_break (0);
+  return NULL;
+}
+
+
+struct GNUNET_CRYPTO_UnblindedSignature *
+GNUNET_CRYPTO_blind_sig_unblind (
+  const struct GNUNET_CRYPTO_BlindedSignature *blinded_sig,
+  const union GNUNET_CRYPTO_BlindingSecretP *bks,
+  const void *message,
+  size_t message_size,
+  const struct GNUNET_CRYPTO_BlindingInputValues *alg_values,
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub)
+{
+  struct GNUNET_CRYPTO_UnblindedSignature *ub_sig;
+
+  if (blinded_sig->cipher != bsign_pub->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  if (blinded_sig->cipher != alg_values->cipher)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+  ub_sig = GNUNET_new (struct GNUNET_CRYPTO_UnblindedSignature);
+  ub_sig->cipher = blinded_sig->cipher;
+  ub_sig->rc = 1;
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    GNUNET_free (ub_sig);
+    return NULL;
+  case GNUNET_CRYPTO_BSA_RSA:
+    ub_sig->details.rsa_signature
+      = GNUNET_CRYPTO_rsa_unblind (
+          blinded_sig->details.blinded_rsa_signature,
+          &bks->rsa_bks,
+          bsign_pub->details.rsa_public_key);
+    if (NULL == ub_sig->details.rsa_signature)
+    {
+      GNUNET_break (0);
+      GNUNET_free (ub_sig);
+      return NULL;
+    }
+    return ub_sig;
+  case GNUNET_CRYPTO_BSA_CS:
+    {
+      struct GNUNET_CRYPTO_CsBlindingSecret bs[2];
+      struct GNUNET_CRYPTO_CsC c[2];
+      struct GNUNET_CRYPTO_CSPublicRPairP r_pub_blind;
+      unsigned int b;
+
+      GNUNET_CRYPTO_cs_blinding_secrets_derive (&bks->nonce,
+                                                bs);
+      GNUNET_CRYPTO_cs_calc_blinded_c (
+        bs,
+        alg_values->details.cs_values.r_pub,
+        &bsign_pub->details.cs_public_key,
+        message,
+        message_size,
+        c,
+        &r_pub_blind);
+      b = blinded_sig->details.blinded_cs_answer.b;
+      ub_sig->details.cs_signature.r_point
+        = r_pub_blind.r_pub[b];
+      GNUNET_CRYPTO_cs_unblind (
+        &blinded_sig->details.blinded_cs_answer.s_scalar,
+        &bs[b],
+        &ub_sig->details.cs_signature.s_scalar);
+      return ub_sig;
+    }
+  }
+  GNUNET_break (0);
+  GNUNET_free (ub_sig);
+  return NULL;
+}
+
+
+enum GNUNET_GenericReturnValue
+GNUNET_CRYPTO_blind_sig_verify (
+  const struct GNUNET_CRYPTO_BlindSignPublicKey *bsign_pub,
+  const struct GNUNET_CRYPTO_UnblindedSignature *ub_sig,
+  const void *message,
+  size_t message_size)
+{
+  if (bsign_pub->cipher != ub_sig->cipher)
+  {
+    GNUNET_break (0);
+    return GNUNET_SYSERR;
+  }
+  switch (bsign_pub->cipher)
+  {
+  case GNUNET_CRYPTO_BSA_INVALID:
+    GNUNET_break (0);
+    return GNUNET_NO;
+  case GNUNET_CRYPTO_BSA_RSA:
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_rsa_verify (message,
+                                  message_size,
+                                  ub_sig->details.rsa_signature,
+                                  bsign_pub->details.rsa_public_key))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  case GNUNET_CRYPTO_BSA_CS:
+    if (GNUNET_OK !=
+        GNUNET_CRYPTO_cs_verify (&ub_sig->details.cs_signature,
+                                 &bsign_pub->details.cs_public_key,
+                                 message,
+                                 message_size))
+    {
+      GNUNET_break_op (0);
+      return GNUNET_NO;
+    }
+    return GNUNET_YES;
+  }
+  GNUNET_break (0);
+  return GNUNET_NO;
+}
+
+
+/* end of crypto_blind_sign.c */