The existence and usefulness of blinding functions will depend on f().
For many interesting functions, computing f' is a
very large effort, so computing f'(b(y)) is as much work as computing f'(y),
so Bob will charge Alice just as much.
In the case of RSA, computing f' is very hard, but maybe
Let y = f(x) and f'(y) = x
Imagine Bob runs a f' cracking service. Imagine Alice has y and wants x. Alice may
or may not know f' however she wishes to take advantage of Bob's f' cracking service
to obtain x. But she doesn't want Bob to know x. Yet she wants Bob to compute it
for her.
Imagine
Ben writes:
Imagine there is a blinding function b, and an unblinding function
b'. Alice sends Bob b(y). Bob produces z=f'(b(y)). Alice extracts x =
b'(z).
Has this been done for RSA etc?
Pass, but I can't see why anyone would, since f'() for RSA is thought to
not exist.
f' exists
