Quote from: andytoshi on March 05, 2014, 04:34:14 AM

You can tell the blindsigner what a and b are, but he can't guarantee that you're not lying to him without also knowing c and d.

Also, there is another problem with using oleganza's scheme as an ordinary split-key scheme: it is not publically verifiable. That is, without revealing enough parameters to expose the private key, you cannot prove to others that the blind signer was actually involved in creating the signature.

I agree, the public verification is a problem. But it seems so close to a threshold scheme I am wondering if a similar construction could be used to achieve this. Maybe revealing T and showing that it could only have been constructed with the knowledge of p and q. Probably needs a lot more thinking about.