Usability of padding scheme in blinded RSA signature? In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following


  This attack works because in this blind signature scheme the signer
  signs the message directly. By contrast, in an unblinded signature
  scheme the signer would typically use a padding scheme (e.g. by
  instead signing the result of a cryptographic hash function applied to
  the message, instead of signing the message itself), however since the
  signer does not know the actual message, any padding scheme would
  produce an incorrect value when unblinded.


Could someone please explain the meaning of the part I emphasized?
In the blind RSA signature scheme the blinding of a message
$m$ (to be blindly signed) is multiplicative with value $r^e$, where
you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the
signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv
m^d \pmod N$ which is a valid (textbook) RSA signature for $m$. 

Padding by the sender

Note, that $m$ could also be the result of any padding method for RSA
signatures, which however
needs to be applied by the sender before blinding. By denoting this padding as $f$ we can simply 
consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).

Padding by the signer

Denoting the blinded message which is sent to the signer as $m'\equiv
mr^e \pmod N$, then padding by the signer means that the signer
changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before
signing. Padding methods for RSA signatures hash the original
message (possibly with some parameters), padd the hash value to some
certain format and the result is then interpreted as an element in
$Z_N$, which is then exponentiated with the private signing exponent
$d$. 

Observe that in doing so the signer padds an already blinded message and denote this padded blinded 
message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied by the
signer, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ 
and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, 
will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed 
(for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).