Which blind signature schemes exist, and how do they compare? I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there should be a elliptic curve scheme, which might have better performance than the other schemes.

In particular I'm interested in:


Performance - how expensive is it to create/validate the signature? I mainly care about the cost for the authority(does signing and verification), and less about the performance of the client (does blinding and verification)
Patents - Is the scheme patented? Have the patents expired?
Simplicity - Is it easy to understand? Is it easy to make subtle mistakes which compromise anonymity or security?


My current evaluation of RSA and Lucre:

Blinded RSA


Requires an RSA private key operation for signing. This is relatively expensive, especially if keys larger keys(say 2048 bit) are used.
Patented by Chaum, but the patents should have expired by now
Quite simple, even I understand it


Lucre


Not sure about the performance, but I don't expect much better performance than with RSA.
Paper claims it is patent free, at least in some variations
There are some subtle points. If used incorrectly the signer might be able to abuse being able to choose k in a way that compromises anonymity. I don't really understand it (yet).


Reading the paper a few more times, it seems like most variants of lucre aren't "real" signatures that can be verified by everyone. But rather you need to perform an interactive probabilistic proof. Some variants doesn't suffer from this problem, but they might have other problems.

My subjective impression is that I don't like lucre. It seems like its only raison d'être is that is avoids Chaum's patents. But if those are expired, this shouldn't be an issue anymore.
I'm still a newbie in the field, but trying to learn something about it I ran into these two papers that you surely know, in case not I'll point them out:


Blind signatures for untraceable payments, Chaum
Provably secure blind signatures schemes, Pointcheval


By the way if you look at the introduction of the second title it seems what your looking for.



A specific link on Electronic Cash from RSA Laboratories:


What is Electronic Money




By studying blind signatures I've read about a scheme based on ElGamal Signature Scheme, I'll provide the information I was able to glimpse.

You can find more details at the following links:


IEEE, A blind signature scheme based on ElGamal signature
Citeseerx, Generalized blind signature schemes


Blinded ElGamal:


Performances:



  Owner Alice needs to compute two online exponentiations modulo $p$
  with a |$q$| bit exponent and one offline inverse modulo $q$.
  
  Notary Nancy needs to compute just one online exponentiations modulo
  $p$ with a |$q$| bit exponent.
  
  Verifier Victor needs to compute two exponentiations instead of the
  three ones required for standard ElGamal scheme.


Note: you can find further references for even more efficient variants in the links I provided.


Patents:


I have no clue!Sorry about that...


Simplicity:


I got it all clear, if reading the papers you have any doubts post them and we can check together!