RSA-blind signatures vs. DSA-blind signatures I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to DSA? DSA appears to be about 6x more performant and is not prone to attacks like timing attacks. The security of RSA scheme isn't even proven, right?

Thanks
Well, I think it is quite hard to give a really objective and complete answer to this question. 

Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure 
if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite recently). RSA blind signatures can be proven secure in the random oracle model under an interactive assumption (the one-more 
RSA inversion assumption), see here. Some people may say that proving security under some interactive
 assumption is not really nice, but we do not have any better arguments for this scheme. A nice thing from a theoretical point of view, however, 
 is that RSA blind signatures are round optimal, i.e., two move (one message to the signer and one back), and thus automatically concurrently secure, i.e., one 
 does not need to care about attacks due to interleaving different signing sessions. 

Schnorr type blind signatures (such as blind DSA signatures) are conceptually not that simple (although also not really complicated) and 
always at least three move (and thus not round optimal). From a provable security point of view they can be proven secure in the random oracle model, 
but as far as I know all reductions require the forking lemma and are thus not really tight. You have to decide on your own if you would rather live with interactive assumptions or loose reductions to the discrete log assumption.

If you are looking for practical blind signatures 
in the discrete log setting, you may also look at BLS blind signatures, which are round optimal and 
can be proven secure in the random oracle model under an interactive assumption (quite similar to that of the RSA blind signature scheme). However, they require gap Diffie Hellman groups, i.e., groups where the DDH is easy, and thus requires pairings.

From an implementation point of view I think it is hard to give a general answer as it really depends over which types of groups you 
are going to instantiate blind signatures in the discrete log based setting.