`BlindRSA.blindSign()` skips the RSAVP1 consistency check on the RSA-RAW path

Start in src/blindrsa.ts at BlindRSA.blindSign(), comparing the RSA-RAW return at lines 149-152 with the verification at lines 166-178. Review rsaRawBlingSign() in src/util.ts and the corresponding check in src/partially_blindrsa.ts; done means the RSA-RAW result receives the same RSAVP1 consistency validation before it is returned.

BlindRSA.blindSign() currently takes a different code path when supportsRSARAW is enabled, skipping the post-sign RSAVP1 consistency check present in the software signing path.

Source references

• supportsRSARAW is an exposed platform parameter in src/index.ts:

  • https://github.com/cloudflare/blindrsa-ts/blob/db4ed09648aa23e2b76407f7a0491b164f10e331/src/index.ts#L128-L139

• In src/blindrsa.ts, the RSA-RAW path returns immediately:

  • https://github.com/cloudflare/blindrsa-ts/blob/db4ed09648aa23e2b76407f7a0491b164f10e331/src/blindrsa.ts#L149-L152

• The non-RSA-RAW path in the same function performs the expected verification and throws on mismatch:

  • https://github.com/cloudflare/blindrsa-ts/blob/db4ed09648aa23e2b76407f7a0491b164f10e331/src/blindrsa.ts#L166-L178

• The helper used by the RSA-RAW branch, rsaRawBlingSign(), just calls crypto.subtle.sign(...) and returns the result directly:

  • https://github.com/cloudflare/blindrsa-ts/blob/db4ed09648aa23e2b76407f7a0491b164f10e331/src/util.ts#L320-L338

• For comparison, PartiallyBlindRSA still performs the RSAVP1/equality check even when it uses rsaRawBlingSign():

  • https://github.com/cloudflare/blindrsa-ts/blob/db4ed09648aa23e2b76407f7a0491b164f10e331/src/partially_blindrsa.ts#L182-L203

Issue

This means BlindRSA.blindSign() behaves inconsistently across implementations:

• software path: signs, verifies m == RSAVP1(s), rejects on mismatch
• RSA-RAW path: returns the signer output without that verification

If the RSA-RAW backend ever returns a faulty signature, this path will propagate it to the caller instead of failing with signing failure.

I am intentionally keeping the claim narrow here: this issue is the missing validation step in the RSA-RAW blind-signing path, not a claim of demonstrated real-world fault injection in a specific deployment. But the code-level inconsistency is real and security-relevant.

Suggested fix

Apply the same RSAVP1 consistency check to the RSA-RAW result before returning it, as is already done in the non-RSA-RAW BlindRSA path and in PartiallyBlindRSA.