# Name of this attack?

I am studying Merkle tree signature. Let $\sigma=(s,Y_s,\sigma_{\text{OTS}},As)$ be a signature of certain document. Here $s$ is the index of leaf, $Y_s$ is the respectively OTS public key and $A_s$ is the authentication path. My questions are:

1) Is there any attack where an adversary changes part of the signature $\sigma$? (For example suppose the adversary changes $\sigma_{\text{OTS}}$ to $\sigma^{*}_{\text{OTS}}$ for her or his convenience).

2) If that attack exist what is the name of that attack?

-
If there were such an attack, it would be called a forgery. The part of the reasoning behind Merkle is that there is no computationally feasible way for doing that. BTW: there's no particular need for a Merkle signature to explicitly include the OTS public key; the verifier can compute the required public key (from the hash and $\sigma_{OTS}$, and then validate that computed public key using the authentication path. –  poncho May 25 at 3:25
@poncho according the postquantum cryptography book of Sendried and et al. it is necessary $Y_s$ in the Merkle signature. Could you explain me please how retrieve $Y_s$ using $\sigma_{\text{OTS}}$ and the hash? –  juaninf May 25 at 3:33
You take the OTS signature and the hash of the message; you compute the forward hash of the OTS signature (according to the bits of the message hash); that gives you an (unauthenticated) value of $Y_s$. You then validate that value of $Y_s$ by computing up the authentication path; if you get the top level hash value, the signature verifies. –  poncho May 25 at 5:05
@poncho Before, $Y_s$ be validated, first needs validation with $X_s$. Then I think that it is necessary ... –  juaninf May 25 at 10:27
$X_s$? What is $X_s$ is the notation you're using? –  poncho May 25 at 13:39