Is this schema secure? I want to know if we use function H as random oracle in RSA Blind Signature and assume that RSA Assumption is correct, is it true that the RSA blind signature schema is secure?(i.e. There isn't any adversary who can create a valid signature on a message that he doesn't queried to signer oracle). Intuitively, I think this is true, but I can't prove it formally. Does anyone have an idea?
Blind signature works as follows: 

(1) User blinds a message $M$ with blinding factor $b$ raise to the public key of the signer $e$ as $ b^e \cdot M $

(2) the signer will blindly sign the value by raising it to its private key $d$, as $ \sigma'^d = b \cdot M^d $

(3) the user will compute the signature $\sigma$ by multiplying $\sigma'$ by $b^{-1}$ as $\sigma = M^d$. 

To forge a valid signature without needing the signer, you can start by an inverse process i.e. create a garbage message and signature pair $&lt;\sigma=M,message=M^e&gt;$.

This will work because when the verifier wants to check the validity of the message, signature pair it will raise the signature $\sigma$ to the public exponent $e$ and it will match. The down point for this is that the adversary will have rubbish message.