RSABlindSignatureServer (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.signers

## Class RSABlindSignatureServer

- java.lang.Object
- - org.bouncycastle.crypto.signers.RSABlindSignatureServer

-     public class RSABlindSignatureServer
      extends java.lang.Object

  Server side of the RSA Blind Signature Scheme with Appendix (RSABSSA) defined in RFC 9474. Implements the `BlindSign` step (sec. 4.3): given a blinded message produced by `RSABlindSignatureClient.blind(byte[])`, compute `s = m^d mod n` and return it, after a self-consistency check (`s^e == m mod n`) that catches CRT faults before the value leaves the server.

  The private-key operation is driven through `RSABlindedEngine` so the modular exponentiation is itself blinded against timing side-channels — orthogonal to the RFC 9474 client/server blinding, which only hides the message.

  The variant choice (PSS vs PSSZERO, randomised vs deterministic) is opaque to the server — only the client cares — so this class is variant-agnostic.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `RSABlindSignatureServer(RSAKeyParameters privateKey)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `byte[]` | `blindSign(byte[] blindedMsg)` RFC 9474 sec. 4.3 `BlindSign`.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### RSABlindSignatureServer

          public RSABlindSignatureServer(RSAKeyParameters privateKey)

      Parameters:
        `privateKey` - the server's RSA private key. CRT-form (`RSAPrivateCrtKeyParameters`) is strongly recommended; the public exponent must be available for the RSAVP1 self-check (RFC 9474 sec. 4.3 step 3).

  - ### Method Detail

    - #### blindSign

          public byte[] blindSign(byte[] blindedMsg)
                           throws CryptoException

      RFC 9474 sec. 4.3 `BlindSign`. Verifies `blindedMsg` as an integer in `[0, n)` of the modulus length, applies RSASP1, and checks that RSAVP1 round-trips back to the input before returning.
      Parameters:
        `blindedMsg` - the blinded message received from the client; must be exactly `modulus_len` bytes.
      Returns:
        the blinded signature, `modulus_len` bytes.
      Throws:
        `CryptoException` - if the input is the wrong length, out of range, or the RSASP1/RSAVP1 round-trip fails (CRT fault).