RSABlindSignatureClient (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.signers

## Class RSABlindSignatureClient

- java.lang.Object
- - org.bouncycastle.crypto.signers.RSABlindSignatureClient

-     public class RSABlindSignatureClient
      extends java.lang.Object

  Client side of the RSA Blind Signature Scheme with Appendix (RSABSSA) defined in RFC 9474. A single `blind(byte[])` call performs both `Prepare` (sec. 4.1) and `Blind` (sec. 4.2); `finalize(Blinded, byte[])` performs `Finalize` (sec. 4.4). The `BlindSign` server step lives in `RSABlindSignatureServer` and the variant choices in `RSABlindSignatureParameters`.

  The client side is therefore two calls — `blind` then `finalize` — with the server's `BlindSign` in between:

       RSABlindSignatureClient client = new RSABlindSignatureClient(
           RSABlindSignatureParameters.RSABSSA_SHA384_PSS_RANDOMIZED, publicKey);

       RSABlindSignatureClient.Blinded blinded = client.blind(msg);

       // send blinded.getBlindedMessage() to the server; receive blind_sig

       byte[] sig = client.finalize(blinded, blindSig);
       // (blinded.getPreparedMessage(), sig) is the RSASSA-PSS pair verifiers check

  The `SecureRandom` used for the prepare prefix, the EMSA-PSS salt, and the blinding factor is supplied at construction; the `(parameters, publicKey)` convenience constructor uses the `CryptoServicesRegistrar` default.

  `Blind` is expressed on the existing BC RSA blinding toolkit — `RSABlindingFactorGenerator`, `RSABlindingParameters` and `PSSSigner` driven by an `RSABlindingEngine` — the same composition `PSSBlindTest` uses for Chaum RSA-PSS blind signing.

  Each request's state is carried by the returned `RSABlindSignatureClient.Blinded` (the blinded message, the prepared message, and the secret unblinding value), so a single instance is reusable across requests.

  For randomised variants the resulting signature is over a prepared message that prepends a fresh 32-byte prefix to `msg` (RFC 9474 sec. 4.1); that prepared message — `RSABlindSignatureClient.Blinded.getPreparedMessage()` — is what downstream verifiers check the signature against, not the original `msg`.

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Class and Description
    --- | ---
    `static class` | `RSABlindSignatureClient.Blinded` Output of `blind(byte[])`.

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `RSABlindSignatureClient(RSABlindSignatureParameters parameters, RSAKeyParameters publicKey)` Equivalent to `RSABlindSignatureClient(RSABlindSignatureParameters, RSAKeyParameters, SecureRandom)` with a `SecureRandom` obtained from `CryptoServicesRegistrar`.
    `RSABlindSignatureClient(RSABlindSignatureParameters parameters, RSAKeyParameters publicKey, java.security.SecureRandom random)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `RSABlindSignatureClient.Blinded` | `blind(byte[] msg)` RFC 9474 `Prepare` (sec. 4.1) followed by `Blind` (sec. 4.2): prepare `msg` (prepend a fresh 32-byte prefix for randomised variants, identity otherwise), EMSA-PSS encode it, draw an invertible blinding factor `r`, and blind the encoding to `z = encoded_msg * r^e mod n`.
    `byte[]` | `finalize(RSABlindSignatureClient.Blinded blinded, byte[] blindSig)` RFC 9474 `Finalize` (sec. 4.4): unblind the server's signature for the supplied `RSABlindSignatureClient.Blinded` request and verify it as a standard RSASSA-PSS signature over the prepared message.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### RSABlindSignatureClient

          public RSABlindSignatureClient(RSABlindSignatureParameters parameters,
                                         RSAKeyParameters publicKey)

      Equivalent to `RSABlindSignatureClient(RSABlindSignatureParameters, RSAKeyParameters, SecureRandom)` with a `SecureRandom` obtained from `CryptoServicesRegistrar`.
      Parameters:
        `parameters` - the RFC 9474 sec. 5 variant.
        `publicKey` - the server's RSA public key.

    - #### RSABlindSignatureClient

          public RSABlindSignatureClient(RSABlindSignatureParameters parameters,
                                         RSAKeyParameters publicKey,
                                         java.security.SecureRandom random)

      Parameters:
        `parameters` - the RFC 9474 sec. 5 variant.
        `publicKey` - the server's RSA public key.
        `random` - source of randomness for the prepare prefix (randomised variants), the EMSA-PSS salt, and the blinding factor; must not be `null` — use `RSABlindSignatureClient(RSABlindSignatureParameters, RSAKeyParameters)` for the `CryptoServicesRegistrar` default.

  - ### Method Detail

    - #### blind

          public RSABlindSignatureClient.Blinded blind(byte[] msg)
                                                throws CryptoException

      RFC 9474 `Prepare` (sec. 4.1) followed by `Blind` (sec. 4.2): prepare `msg` (prepend a fresh 32-byte prefix for randomised variants, identity otherwise), EMSA-PSS encode it, draw an invertible blinding factor `r`, and blind the encoding to `z = encoded_msg * r^e mod n`. The returned `RSABlindSignatureClient.Blinded` carries the prepared message, the `blinded_msg` to send to the server, and the secret unblinding value for `finalize(Blinded, byte[])`.
      Parameters:
        `msg` - the application message to be signed.
      Throws:
        `CryptoException` - if EMSA-PSS encoding fails (e.g. the modulus is too small for the variant's hash/salt lengths) or the encoded message is not coprime with the modulus.

    - #### finalize

          public byte[] finalize(RSABlindSignatureClient.Blinded blinded,
                                 byte[] blindSig)
                          throws CryptoException

      RFC 9474 `Finalize` (sec. 4.4): unblind the server's signature for the supplied `RSABlindSignatureClient.Blinded` request and verify it as a standard RSASSA-PSS signature over the prepared message.

      The method name follows the RFC 9474 sec. 4.4 `Finalize` step; it is an overload of `Object.finalize()` (distinct signature), not an override.

      Parameters:
        `blinded` - the value returned by `blind(byte[])` for this request.
        `blindSig` - the `blind_sig` returned by the server.
      Returns:
        the unblinded RSASSA-PSS signature; it verifies against `blinded.getPreparedMessage()`.
      Throws:
        `CryptoException` - if `blindSig` has the wrong length or the unblinded signature fails RSASSA-PSS verification.