基于 RSA 盲签名的匿名认证调查系统 Noon

1. Client Device

Hash & Blind

Multiplies hash with secret factor r

m' = (m · r^e) mod n

Authenticated Request

m' (Blinded Hash)

2. Signing Server

Blind Signature

Signs without seeing payload m

s' = (m')^d mod n

3. Client Device

Unblind

Removes blinding factor r

s = (s' · r^-1) mod n

Unauthenticated Path

Zero Session Cookies

4. Public Verifier

Anonymous Proof

Verifies without user linkage

m ≡ s^e mod n ✓

The signing authority signs the blinded hash m' without seeing the submission payload m. The submitter unblinds s' and submits anonymously.

Most web applications promising "anonymous feedback" or "confidential voting" rely on policy assurances while continuing to record IP addresses, session cookies, and browser fingerprints. Noon eliminates the need for organizational trust by using RSA Blind Signature Cryptography, mathematically breaking the connection between a participant's identity and their response.

The Cryptographic Math of Blind Signatures

First designed by cryptographer David Chaum in 1983, blind signatures enable an authority to sign a digital document without observing its contents. The resulting signature is verifiable by anyone using the signer's public key, yet cannot be correlated with the original signing transaction.

The Five-Step RSA Process

Setup: The server maintains an RSA key pair (n, e, d) and publishes the public modulus n and exponent e.
Blinding: The client computes the digest of their answers m = SHA256(Submission || Nonce). Choosing a random blinding factor r where gcd(r, n) = 1, the client blinds the digest:
m' = (m · r^e) mod n
Signing: The server verifies that the user is authorized to submit, signs the blinded value m', and decrements the user's signature balance:
s' = (m')^d mod n ≡ (m^d · r) mod n
Unblinding: The client receives s' and removes the random factor r by multiplying with its modular inverse:
s = (s' · r^-1) mod n ≡ m^d mod n
Anonymous Verification: The client submits the submission data, nonce, and signature s across an unauthenticated connection. The server verifies that:
m ≡ s^e mod n

Authentication Without Deanonymization

Preventing spam without identifying submitters requires a decoupled, two-stage architecture:

Step 1 (Authenticated Token Exchange): The participant proves eligibility using standard authentication (e.g., OTP or verified account). The server validates permission and signs the blinded payload, recording only that this specific account used its submission right.
Step 2 (Unauthenticated Payload Submission): The client unblinds the signature and dispatches the answers with signature s through an isolated network request stripped of session cookies, authentication tokens, or identifying headers.

Where Cryptographic Anonymity Actually Matters

Most organizations do not leak survey results maliciously; they leak them architecturally. When data collection relies on administrative trust, real anonymity collapses under routine operational pressures. Cryptographic unlinking replaces good intentions with mathematical guarantees across several critical scenarios:

1. High-Stakes Workplace Surveys and the Third-Party Trust Tax

Almost every employee has encountered the "strictly confidential" disclaimer on an internal pulse check or quarterly review, usually sent through a personalized email link or authenticated behind company SSO. In reality, HR dashboards regularly filter responses by team, tenure, and department. When an engineering sub-team consists of four people and one gives a scathing review of executive strategy or manager competence, deanonymization takes roughly thirty seconds.

This dynamic creates a peculiar corporate absurdity: companies spend large annual budgets on third-party survey vendors like Culture Amp or Qualtrics simply to ask their own workforce questions. Leadership cannot run internal feedback forms because employees know internal IT admins and managers control the database. To solicit honest data, leadership outsources the survey to an outside vendor under a contractual pledge: the vendor promises only to share aggregated scores back with the employer.

Yet outsourcing does not solve the architecture problem; it merely relocates it. The third-party vendor still records employee email addresses, session cookies, IP addresses, and raw survey answers in a centralized cloud database. If that vendor suffers a data leak, misconfigures an API endpoint, or faces litigation discovery in an employment dispute, the entire unmasked feedback history is exposed. Furthermore, cross-referencing demographic cuts on vendor dashboards (such as location combined with job level) frequently deanonymizes respondents anyway.

With Noon, organizations do not need to pay an outside honesty referee. Eligibility verification is completely severed from response ingestion. The internal identity provider validates that a submitter holds an active employee account and signs a blinded token, recording only that this user consumed their submission right. Once unblinded, the response travels over an unauthenticated connection. The database stores no foreign key to an employee record, no tracking cookie, and no user ID. Even if the executive team and database administrators conspire to inspect the database directly, the data linkage simply does not exist to be recovered.

2. Digital Elections, Governance, and Board Balloting

Electronic voting historically struggles with a stubborn conflict: how to enforce strict eligibility (one person, one vote) while preserving an untouchable secret ballot.

Traditional voting platforms authenticate users via email, SMS OTP, or government ID, and then log the cast vote in the same application database. If that database is subpoenaed, leaked, or inspected by an insider, ballot secrecy disappears. Dissenters can be quietly audited, marginalized, or pressured.

RSA blind signatures resolve this tradeoff cleanly:

Eligibility Verification: The election authority checks the voter against the registered roll, verifies their credential, and signs a blinded ballot serial without seeing the vote or the final serial number.
Unlinked Ballot Casting: The voter's client unblinds the signature locally and drops the ballot into the public collection endpoint across an unauthenticated channel. The server verifies the signature against the election authority's public key and appends the vote to the ledger.
Replay Prevention Without Tracking: The server records each ballot's unblinded nonce in a spent-tokens set. Attempting to submit a second ballot with the same nonce fails as a duplicate, while crafting an unauthorized ballot fails cryptographic verification.

3. Whistleblowing, Safety Reporting, and Incident Post-Mortems

In healthcare, aviation, and software infrastructure, post-incident reviews and safety reporting rely on surfacing uncomfortable truths: near-miss outages, bypassed security controls, or ignored warnings. When reporting systems require persistent user profiles, junior engineers and operators hesitate to report mistakes out of fear of blame or formal reprimand.

By enforcing mathematical blinding, reporting platforms can guarantee that a submission came from a verified insider authorized to report, while guaranteeing that the report cannot be traced back to the person who raised the alarm.

Network-Level Anonymity and Future Hardening

While blind signatures make cryptographic payload linkage impossible, network-level side channels must also be addressed in high-stakes environments:

Routing via Tor / Proxies: Separating the network path of the signing request from the submission request to prevent IP correlation.
Temporal Decoupling: Adding randomized delays between receiving the signature and submitting the response to defeat timing analysis.
Client Sandboxing: Standardizing user-agent strings and headers to prevent browser fingerprinting.

Try Noon for yourself

Experience zero-knowledge forms and surveys powered by RSA blind signatures.

Try for yourself

You can also explore the open-source implementation of Noon on GitHub at github.com/lupyd/noon.